# Aztec Discloses Critical Proving-System Flaw That Let Invalid Transactions Pass Verification on Its V5 Alpha Network

Core contributors found the defect through internal artificial-intelligence-assisted auditing and say funds, applications and contract state on V5 should be treated as exposed until remediation completes.

- Published: 2026-09-17T05:45:36.942Z
- Canonical: https://polylog.news/crypto/2026-09-17/aztec-discloses-critical-proving-system-flaw-that-let-invali
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Aztec Network](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), [Aztec Network](https://aztec.network/alpha-v5), [Aztec Network](https://aztec.network/blog/how-gas-works-on-aztec)

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical vulnerability in the [proving system behind its V5 alpha network](https://aztec.network/blog/alpha-v5-proving-system-vulnerability). The defect allows an attacker to construct a zero-knowledge proof that passes verification for a transaction the network should reject. A transaction accepted that way can produce a state transition outside the rules V5 is meant to enforce.

That is a soundness failure, a different category of risk from a smart-contract bug. The proof is the only safeguard between a submitted transaction and the network's recorded state. Aztec's contributors say the finding places [V5 funds, applications and contract state at risk](https://aztec.network/alpha-v5) and that they cannot determine whether anyone exploited the flaw before it was found. Internal and external human audits had already been completed. The defect surfaced through continuing artificial-intelligence-assisted review by core contributors.

This is not the first time Aztec has disclosed a defect like this. The team disclosed a critical vulnerability in the V4 alpha in March 2026, described it as affecting the proving system as a whole, and told users to withdraw before a deadline in June. Two consecutive alpha releases with proving-system defects form a pattern, and the reasonable conclusion is that the proving stack for private execution is not yet a settled engineering problem.

The structural point extends beyond Aztec. Most optimistic rollups rely on validators re-executing transactions as a fallback, which catches execution bugs. Re-execution cannot catch a proof that verifies when it should not, because the verifier itself is the broken component. That is why disclosures of this kind arrive under embargo and timed to an upgrade, and why proof-system diversity and working exit mechanisms are becoming design requirements rather than optional improvements.

## What this means

A soundness bug in a proving system undermines the core guarantee a zero-knowledge rollup offers its users. Anyone using a chain that settles on a single proof system carries this risk whether or not they can see it, because there is no independent check that would catch a verifier accepting an invalid proof. The immediate exposure is limited, since V5 is explicitly alpha software holding correspondingly small balances. The longer-term consequence is competitive. Teams that ship proof diversity and user-controlled exits will have a concrete answer to this risk, while teams that cannot will keep asking users to trust a single verifier. It also shows that machine-assisted auditing can now find defects that completed human audits missed, which benefits whichever side, attackers or defenders, uses it first.

## What to watch

- Whether Aztec publishes the specific soundness defect and its remediation once network operators have acted, since a detailed account would tell other proving teams whether this bug class applies to their own circuits.
- Whether other zero-knowledge rollups announce proof-system diversity or independent verifier implementations in response, which would mark a shift from treating soundness as an audit checkbox to treating it as a redundancy requirement.
- How many similar defects are found by artificial-intelligence-assisted review compared with human audit over the coming months, since that ratio will determine whether audit budgets shift toward automated analysis.