Aztec Says a Flaw in Its Alpha V5 Proving System Could Let an Invalid Transaction Pass Verification

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical defect in the proving system behind its Alpha V5 release. According to the team, an attacker may be able to construct a proof that passes verification for a transaction the network should reject. That is a soundness failure, not a liveness problem: the verifier wrongly accepts an invalid transaction as valid.

Two details matter more than the bug itself. Core contributors identified it on 27 July 2026 through internal auditing assisted by artificial intelligence, after internal and external human audits had already completed. And the team states it cannot determine whether anyone exploited the flaw before the finding. Aztec says funds, applications and contract state on V5 should be treated as exposed to a protocol-level failure until operators complete the required network actions, and that reviewers have found no other critical or high-severity issues in V5 so far.

Soundness bugs sit in a different risk class from smart-contract exploits. A rollup that relies on validity proofs has no fallback of re-execution by independent validators to catch a forged proof, so the proving stack becomes a single point of correctness for every user balance it secures. Layer-2 networks tracked by L2Beat currently secure $48.85 billion in total value.