Aztec Says a Flaw in Its V5 Proving System Could Let an Invalid Transaction Pass Verification

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical vulnerability in the proving system behind its Alpha V5 release. According to the project, an attacker may be able to construct a proof that passes verification for a transaction the network should reject. If the network accepted such a proof, it would produce a state transition outside the rules V5 is meant to enforce. Aztec says core contributors identified the defect on 27 July 2026 through internal auditing assisted by artificial intelligence, after both internal and external human audits had already finished.

The project told users to treat funds, applications and contract state on Alpha V5 as exposed to a protocol-level failure until contributors finish incident response and network operators carry out the required actions. Reviewers have not identified other high-severity or critical defects in V5 at this time.

This is the second proving-system failure Aztec has disclosed this year. It reported a critical vulnerability in Alpha V4 in March, saying the flaw affected the proving system as a whole and could lead to theft of user funds, and it told V4 users to withdraw before 25 June because the V5 governance proposal would make the underlying V4 bugs public.

The category matters more than the individual bug. A soundness defect is not a smart-contract bug that a careful reader of Solidity can spot. It exists within the mathematics and the circuit implementation that determine which state transitions are valid at all. Most optimistic and hybrid rollups rely on validators re-executing transactions, but on a network where transaction contents are encrypted by design, that fallback does not exist. The safety of user balances depends on the correctness of the verifier and on the operators who can pause or upgrade the chain, which is the opposite of the credible-neutrality claim privacy rollups make in their marketing.