Aztec Discloses a Critical Proving-System Flaw in Its Alpha V5 Privacy Network

Aztec, the Ethereum layer-2 network built for private smart contracts, has disclosed a critical vulnerability in the proving system of its Alpha V5 release. Core contributors identified the defect in late July through internal review assisted by AI tooling, not through an external attack.

The failure class matters more than any single bug. In a zero-knowledge rollup, the proof is the guarantee. An attacker who can construct a proof that verifies for a transaction the network should reject does not need to break a contract, steal a key or manipulate a price. The chain accepts the invalid state as correct. This is precisely the risk that ordinary validator re-execution cannot catch, because on a privacy network there is no public transaction body for other nodes to re-run. The soundness of the prover is the last line, and when it fails there is no second check behind it.

Aztec has now been through this cycle twice in one year. In March the team disclosed a critical proving-system vulnerability in Alpha V4, kept the technical detail private until the successor release shipped, and told V4 users to withdraw ahead of the cutover. Alpha V5 was itself presented as the version that fixed those flaws. The team has raised its bug bounty to $2 million and continues to publish operational documentation, including how transaction fees work on the network.

The context is a privacy sector that is being pitched to institutions as production-ready. Aztec's total value secured is small next to the general-purpose rollups. Layer-2 networks tracked by L2Beat hold $44.01 billion in total, with Base at $12.36 billion and Arbitrum One at $11.61 billion. Repeated soundness defects in a live privacy network give the institutions weighing confidential execution a concrete reason to wait for proof-system maturity, and they give the argument for proof diversity and working escape hatches its strongest evidence yet.