Aztec Discloses a Proving-System Flaw That Could Let Invalid Transactions Pass Verification

Aztec, the privacy-focused layer-2 network on Ethereum, has disclosed a critical vulnerability in the proving system behind its Alpha V5 release. According to the disclosure, an attacker may be able to construct a proof that passes verification for a transaction the network should reject, which would produce a state transition outside the rules the protocol intends to enforce. Contributors identified the defect on 27 July 2026 through internal auditing assisted by artificial intelligence, and they state they cannot determine whether anyone exploited it beforehand.

Aztec tells users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure until incident response finishes and node operators complete the required network actions. The fix is planned for V6. Reviewers say internal and external human audits have completed without finding other critical or high-severity issues in V5, and that machine-assisted review continues.

This is the second consecutive Alpha version to carry a critical proving-system defect. Aztec disclosed a comparable flaw in Alpha V4 in March, with the patch shipped in the V5 release. The pattern matters because a soundness bug in a zero-knowledge proving system (cryptographic code that lets a network confirm a transaction is valid without re-executing it) is a different risk class from a smart-contract bug. Validators cannot catch it by re-executing transactions, since the fraudulent proof verifies correctly by construction. The network's Alpha V5 program has meanwhile been onboarding private applications, including a version of the on-chain game Dark Forest, so the exposed state is no longer purely experimental.

There is a second point worth noting. The defect was found by an internal audit process using artificial intelligence, the defensive counterpart to an argument now common in crypto security, where the same capability said to threaten cryptographic assumptions is also accelerating the discovery of implementation errors before attackers can exploit them.