Aztec Says a Proving-System Flaw Lets an Invalid Transaction Pass Verification on Alpha V5

Aztec, the privacy-focused Ethereum layer-2 network, disclosed a critical vulnerability in the proving system that secures its Alpha V5 release. By the project's own description, an attacker may be able to construct a proof that passes verification for a transaction the network is supposed to reject. If the network accepts that proof, the chain can move into a state its rules forbid.

That is a different class of failure from a smart-contract bug. In a zero-knowledge system, the proof is the only thing a verifier checks, so a soundness defect turns the verification step itself into the weak point. Re-execution by validators, the fallback most rollups rely on, cannot detect it, because the invalid transition is accepted as valid by construction.

Aztec says core contributors identified the flaw through internal auditing assisted by artificial-intelligence tooling, after internal and external human audits had already completed without finding it. The project says reviewers have identified no other high-severity or critical issues in V5 at this time, and that the fix ships in V6, planned for later in 2026. Until incident response and operator action finish, Aztec advises users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure. Applications are already live on the network.

The disclosure challenges the central promise of shielded systems directly. A privacy chain asks users to trust mathematics instead of an operator, and a proving bug converts that trust into the possibility of unauthorized state changes inside a set where balances are hidden by design.