Aztec Discloses Soundness Flaw in Its Alpha V5 Proving System, With the Fix Deferred to V6

Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system behind its Alpha V5 release. Core contributors identified the defect on July 27 through internal auditing assisted by artificial intelligence tools. The flaw is a soundness failure: an attacker could construct a zero-knowledge proof that passes verification for a transaction the network should have rejected.

The distinction matters because of what it breaks. A smart-contract bug lets an attacker misuse rules the chain still enforces correctly. A soundness bug in the proving system means the chain's own verification of validity returns the wrong answer. On a network where transaction contents are private by design, the usual fallback of having validators re-execute transactions and compare results does not apply, because there is nothing public to re-execute. Aztec said internal and external human audits have completed, that reviewers have not found other high-severity or critical issues in Alpha V5, and that the correction is planned for V6.

This is the second such disclosure in the same product line. Aztec disclosed a critical vulnerability in Alpha V4 in March, saying it affected the proving system as a whole and could lead to severe disruption and theft of user funds, and it advised V4 users to withdraw before the V5 governance vote made the details public. The pattern that has now formed is embargoed disclosure timed to a scheduled upgrade, which is the only sequencing available when the bug is in the verifier itself.

Aztec has continued to ship in parallel. The network has published documentation on how transaction fees work on the chain and an Alpha V5 release page, and it has raised its bug bounty to $2 million. Notably, the finding came from internal AI-assisted review rather than an external attacker or a bounty hunter, which is the same discovery channel now surfacing defect backlogs across open-source cryptographic libraries.