Aztec Says a Flaw in Its Alpha v5 Proving System Could Have Let a False Proof Pass Verification

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical vulnerability in the proving system behind its Alpha v5 release. According to the team, an attacker could construct a proof that passes verification for a transaction the network should have rejected. Core contributors identified the defect on 27 July through internal auditing assisted by automated code analysis, and the repair is scheduled for the next version rather than a patch to the running network.

This is a different class of failure from a smart-contract bug. In a zero-knowledge system, the proof is the only thing a verifier checks. If the proving circuit is unsound, the verifier accepts a false claim, and every downstream assumption about balances and ownership fails at once. Validator re-execution, the fallback that catches ordinary execution errors on optimistic systems, does not detect it, because the network never sees the underlying computation.

The disclosure follows the same pattern Aztec used in March, when it announced a critical vulnerability in Alpha v4 and shipped the fix inside the v5 release. Aztec has raised its bug bounty to $2 million and says reviewers have not identified other high-severity findings in v5 at this time. The network remains an alpha deployment, which is why the team can hold a soundness defect for a scheduled upgrade rather than trigger an emergency response.

The straightforward reading is that repeated findings in a maturing prover are what alpha testing is for. The harder one is that these bugs are being found by the team that wrote the code, and that no independent party has demonstrated it can find them first.