← The Polylog Crypto Intelligence Brief
Morning Edition · Thursday, August 20, 2026Published at 1:47 AM EDT · New York
Aztec Says a Flaw in Its Alpha V5 Proving System Can Make an Invalid Transaction Verify
Core contributors found the defect on July 27 through internal auditing assisted by artificial intelligence, and told users to treat funds, applications and contract state on V5 as exposed until operators complete the response.
Aztec, the privacy-focused layer-2 network on Ethereum, disclosed a critical vulnerability in the proving system behind its Alpha V5 release. The described failure is a soundness defect: an attacker may be able to construct a zero-knowledge proof that passes verification for a transaction the network should have rejected. Contributors identified the issue on July 27 through internal auditing assisted by artificial intelligence, and said funds, applications and contract state on V5 should be treated as exposed to a protocol-level failure until incident response finishes and operators carry out the required network actions.
This is a different risk class from a smart-contract bug. On a network that hides transaction contents, the proof is the only thing a verifier checks. There is no re-execution fallback, because no other party can see the inputs to recompute them. A soundness break therefore reaches the whole system at once rather than one application.
It is also the second such disclosure in the same programme. Aztec published a critical vulnerability in Alpha V4 earlier this year, and its governance process required the underlying V4 bugs to be made public when the V5 upgrade went on-chain. The project continues to ship application-layer work, including a live on-chain game built on private state, while the base layer remains explicitly labelled alpha software.
The straightforward reading is that the disclosure process worked as designed and that the technology is not finished. Both statements are true at the same time.
Veracity: Corroborated
85/100- If true, who benefits
Aztec gains credibility for disclosing before an attacker acted, and competing zero-knowledge networks gain from a rival's proving stack being labelled unfinished.
- The nuance
Part of a tracked trend
Proving-System Bugs Become a Distinct Rollup Risk
Soundness defects in zero-knowledge proving systems will keep surfacing as a risk class separate from smart-contract exploits, because validator re-execution — the fallback most rollups rely on — cannot catch them, forcing teams into embargoed disclosure timed to upgrades and pushing users toward proof-system diversity and escape hatches.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Treasury Doubles Long-Bond Buybacks, and Crypto Prices Follow the Yield Curve Down
- BitBox Patches Two Severe Wallet Firmware Bugs Found by Its Own AI-Assisted Audit
- Bridge Signatures and Hot Wallets Drive Nearly $40 Million of Recent Crypto Thefts
- Trump Presses the Senate on the CLARITY Act as a Lead Democrat Warns Against Rushing It
- CFTC Opens a Rulemaking Path for Compute Derivatives and Signals a Route Onshore for Hyperliquid
- Solana Cuts Block Times to 350 Milliseconds and Trims the Compute Budget to Match
- Researchers Propose a Cross-Chain Design That Never Locks Assets in a Bridge Contract
Comments
1Aug 21, 4:30 AM · edited
Because Aztec V5 hides transaction contents, post disclosure forensics cannot determine whether the soundness bug was exploited, making full state exposure the only defensible posture rather than a conservative one.