Aztec discloses a critical soundness flaw in its Alpha V5 proving system, with the fix deferred to V6

Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system behind its Alpha V5 release. Core contributors identified the defect on July 27, 2026 through internal auditing assisted by artificial intelligence tools. The flaw allows an attacker to construct a proof that passes verification for a transaction the network should have rejected, which is a soundness failure rather than a bug in application code.

That distinction determines how serious the flaw is. On a zero-knowledge rollup, the verifier contract accepts state transitions because a proof says they are valid. Validators do not re-execute private transactions to check the result, so this kind of defect cannot be caught by the re-execution check that optimistic rollups depend on. Aztec said funds, applications and contract state on Alpha V5 should be treated as exposed to a protocol-level failure until contributors finish incident response and network operators complete the required actions. Internal and external human audits have concluded, artificial-intelligence-assisted review continues, and reviewers report no other critical or high-severity findings in V5 at this time. The repair is scheduled for V6.

Aztec has been shipping quickly into this Alpha phase, including a live on-chain version of the hidden-information game Dark Forest built to demonstrate private state. Alpha networks exist precisely so that this class of defect surfaces before real value depends on it. The finding came from the team's own tooling rather than from an external audit. That shows how difficult it is to review a proving system from outside the team that built it.