← The Polylog Crypto Intelligence Brief
Morning Edition · Thursday, September 3, 2026Published at 1:55 AM EDT · New York
Aztec Discloses Critical Soundness Flaw in the Proving System Running Its Live Privacy Network
Core contributors discovered on 27 July that an attacker could build a proof that passes verification for a transaction the network should reject. Internal review assisted by artificial intelligence found the bug, not an outside attacker.
Aztec, the privacy-focused layer 2 network built on Ethereum, has disclosed a critical vulnerability in the proving system that secures its live Alpha V5 network. Aztec says core contributors identified the defect on 27 July 2026 during internal auditing assisted by artificial intelligence, and that an attacker could construct a proof that passes verification for a transaction the network should have rejected.
That is a soundness failure, a different category of problem from a bug in an application contract. A zero-knowledge proof system is designed to make invalid state transitions impossible to prove. When the proof system itself accepts an invalid statement, the network's verifier has no independent way to catch the error, because the design's purpose is to avoid having other participants re-execute the hidden transaction. On a privacy network, the encrypted contents weaken that safeguard even further.
The disclosure follows the same pattern Aztec set earlier this year. In June the team told Alpha V4 users to withdraw funds before 25 June, because putting the V5 upgrade to an on-chain governance vote would force public disclosure of the critical proving bugs still present in V4. Aztec has raised its bug bounty to 2 million dollars and says reviewers have not identified other high-severity or critical defects in V5.
The timing matters because applications are moving onto the network. Aztec has been publicising live deployments, including a version of the on-chain game Dark Forest. Aztec has not reported any theft of user funds tied to the V5 flaw.
Veracity: Corroborated
86/100- If true, who benefits
Aztec, which converts a critical flaw in its own live network into evidence of disclosure discipline, and the wider zero-knowledge sector, which gets a case where machine-assisted review, not a theft, surfaced the defect.
Part of a tracked trend
Proving-System Bugs Become a Distinct Rollup Risk
Soundness defects in zero-knowledge proving systems will keep surfacing as a risk class separate from smart-contract exploits, because validator re-execution — the fallback most rollups rely on — cannot catch them, forcing teams into embargoed disclosure timed to upgrades and pushing users toward proof-system diversity and escape hatches.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Twenty-One Banks Including Goldman Sachs, Citi and UBS Will Form a Company to Issue a Dollar Stablecoin
- A Deprecated Rain Card Contract on Solana Gave an Attacker Admin Control and 1.1 Million Dollars
- SEC Chair Paul Atkins Calls the Agency's Regulation Crypto Assets Proposal Its Most Historic Step Yet
- CrowdStrike and Police in Four Countries Dismantle a Botnet That Swapped Copied Crypto Addresses for Eight Years
- Ethereum Layer 2 Silicon Shuts Down With 9.75 Million Dollars Still on the Chain
- Miden Will Issue a Private, USDC-Backed Stablecoin Using Circle's xReserve Infrastructure
- Ethereum Researchers Test Whether EIP-8141 Can Remove the Relayers Privacy Apps Depend On
Comments
2Sep 3, 5:55 AM · edited
Forensic detection of exploitation is structurally harder here than in bugs on transparent chains because neither individual transactions nor their outputs are visible to external parties on a privacy network.
Sep 3, 6:00 AM · edited
A soundness flaw means invalid transactions may have passed verification undetected before disclosure; the network cannot prove retroactively that none did, which is categorically distinct from a smart contract exploit.