Aztec Discloses Soundness Flaw That Could Let a Forged Proof Pass Verification

Aztec, the layer-2 network built for private smart contracts on Ethereum, has disclosed a critical vulnerability in the proving system behind its Alpha V5 network. According to the network's disclosure, an attacker may be able to construct a proof that passes verification for a transaction the network should reject. Contributors say funds, applications and contract state on V5 should be treated as exposed until incident response finishes. The flaw was found through internal auditing assisted by artificial intelligence, after internal and external human audits had already completed.

A soundness defect is a different class of failure from a smart-contract bug, and the difference is what makes it serious. In a validity rollup, the proof is the authority. If the verifier accepts an invalid state transition, every downstream check that trusts the proof inherits the error, and the usual fallback of re-executing transactions to detect a bad block does not help, because the chain's own rules say the proof was valid. Audits scoped to application code cannot see this surface at all.

This is the second consecutive Aztec release cycle with a proving-system disclosure. The team previously reported a critical vulnerability in Alpha V4 that it said affected the proving system as a whole and could lead to protocol disruption and theft of user funds, and it withheld the technical details until V5 shipped. Embargoed disclosure timed to an upgrade is now a standard pattern for zero-knowledge teams, and it forces users to weigh the cost of staying on a network with a known unpatched class of bug against the cost of exiting.

The exposure is not theoretical, because applications are live. Aztec has been onboarding consumer software and games onto the network, including a private-state version of Dark Forest, and the whole design premise of the chain is that balances and contract state stay hidden. Privacy raises the cost of incident response. On a transparent chain, observers can measure a drain in real time. On a shielded one, the people best placed to see an exploit are the attacker and the operator.

Both sides of the artificial-intelligence security argument appear in the same incident. Machine-assisted review caught a defect that human auditors missed, which supports the claim that these tools strengthen defense. It also demonstrates that production zero-knowledge systems contain findable soundness bugs, which is exactly what the other side of that argument warns about.