Aztec Discloses a Soundness Flaw in Its Alpha v5 Proving System

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical vulnerability in the proving system of its Alpha v5 release. In Aztec's description of the flaw, an attacker could build a proof that passes verification for a transaction the network is supposed to reject. That is a soundness break rather than a smart-contract bug, and it is the failure class that matters most for a chain where validity proofs, not re-execution by validators, are what keep the ledger honest.

Aztec said core contributors identified the defect through internal auditing assisted by artificial intelligence, after internal and external human audits of the same code had already completed. The team frames the finding as the purpose of an alpha period and has scheduled the remediation for the next version rather than shipping an emergency patch, which follows the pattern it used for a comparable proving-system flaw in Alpha v4, disclosed only once users had been told to withdraw.

That disclosure policy is the contested part. Embargoing details until an upgrade lands protects users from an attacker reading the advisory first. It also means the people holding funds on the live network are asked to trust a team's private assessment of a bug they cannot evaluate. For a privacy chain, the tension is sharper than usual, because shielded balances make it harder for outside observers to confirm whether an exploit has already occurred.

A soundness bug in a zero-knowledge system is also structurally different from a contract exploit. On an optimistic rollup, honest parties can re-execute transactions and dispute a bad state root. On a validity rollup, a proof that verifies is accepted, so no fallback catches a forged proof. That is why proof-system diversity, escape hatches and slow upgrade paths have become the standard mitigations rather than faster patching.