Aztec Says a Flaw in Its Alpha V5 Proving System Can Validate Transactions the Network Should Reject

Aztec Network, an Ethereum layer-2 built for private smart contracts, has disclosed a critical vulnerability in the proving system that secures its live Alpha V5 network. Core contributors identified the defect on 27 July 2026 during internal auditing assisted by artificial intelligence tools. According to the disclosure, an attacker may be able to construct a proof that passes verification for a transaction the network is supposed to reject, which would allow a state transition outside the rules the protocol intends to enforce.

Aztec told users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure until contributors finish incident response and operators complete the required network actions. Contributors said they cannot determine whether anyone exploited the flaw before they found it. Reviewers have not identified other critical or high-severity findings in V5, and the correction is planned for V6, the next version of the network.

This is the second proving-system failure Aztec has disclosed this year. It warned V4 users to withdraw before publicly disclosing an earlier critical flaw, and it has since raised its bug bounty to two million dollars.

The class of bug matters more than the individual product. A soundness defect in a zero-knowledge proving system is not a smart-contract bug. The fallback that most optimistic rollups rely on, honest parties re-executing transactions and challenging bad state, does not exist in the same form for a validity-proof chain, because the chain accepts whatever the verifier accepts. That places unusual weight on a small number of cryptographic implementations, and on the fee and operator design that decides who can push a proof on-chain in the first place. Aztec's own account is also a data point in a separate argument: the flaw was surfaced by machine-assisted review rather than by an attacker.