Aztec Discloses Critical Soundness Flaw in Its Alpha v5 Proving System

Aztec, the privacy-focused layer-2 network on Ethereum, disclosed a critical vulnerability in the proving system behind its Alpha v5 release. According to the project's own disclosure, an attacker may be able to construct a proof that passes verification for a transaction the network is supposed to reject, which would let the chain accept a state transition outside its own rules. Core contributors found the flaw through internal review, and they say they cannot determine whether anyone exploited it beforehand. Funds, applications and contract state on v5 should be treated as exposed until incident response finishes and operators complete the required network actions.

This is a different category of failure than a smart-contract bug. On a zero-knowledge rollup, the cryptographic proof itself certifies a transaction as valid, and there is no separate check behind it. If the verifier accepts an invalid proof, no amount of contract auditing would catch the error. The safeguard optimistic rollups rely on, independent re-execution of transactions by validators, does not exist in the same form here. That is why a soundness defect forces a network pause and a system upgrade rather than a patch to a single application.

This is not Aztec's first such disclosure. The project published a critical vulnerability notice for Alpha v4 earlier in its testing cycle and raised its bug bounty to $2 million. Both facts point to the same conclusion: this is alpha software, and the team treats pre-mainnet disclosure as the intended result of its review process, not as a failure.

This disclosure comes amid a broader wave of privacy-focused development. Aztec's own applications, including a live on-chain game and private decentralized finance (DeFi) integrations, run on the same proving stack that contains the flaw.