Aztec Discloses Critical Proving-System Flaw That Let Invalid Transactions Pass Verification on Its V5 Alpha Network

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical vulnerability in the proving system behind its V5 alpha network. The defect allows an attacker to construct a zero-knowledge proof that passes verification for a transaction the network should reject. A transaction accepted that way can produce a state transition outside the rules V5 is meant to enforce.

That is a soundness failure, a different category of risk from a smart-contract bug. The proof is the only safeguard between a submitted transaction and the network's recorded state. Aztec's contributors say the finding places V5 funds, applications and contract state at risk and that they cannot determine whether anyone exploited the flaw before it was found. Internal and external human audits had already been completed. The defect surfaced through continuing artificial-intelligence-assisted review by core contributors.

This is not the first time Aztec has disclosed a defect like this. The team disclosed a critical vulnerability in the V4 alpha in March 2026, described it as affecting the proving system as a whole, and told users to withdraw before a deadline in June. Two consecutive alpha releases with proving-system defects form a pattern, and the reasonable conclusion is that the proving stack for private execution is not yet a settled engineering problem.

The structural point extends beyond Aztec. Most optimistic rollups rely on validators re-executing transactions as a fallback, which catches execution bugs. Re-execution cannot catch a proof that verifies when it should not, because the verifier itself is the broken component. That is why disclosures of this kind arrive under embargo and timed to an upgrade, and why proof-system diversity and working exit mechanisms are becoming design requirements rather than optional improvements.