Aztec Discloses a Soundness Flaw in Its Alpha V5 Proving System, With the Fix Deferred to V6

Aztec, the privacy-focused layer-2 network on Ethereum, has published a disclosure covering a critical vulnerability in the proving system behind its Alpha V5 release. Core contributors found the defect through internal auditing assisted by artificial intelligence tooling. In Aztec's description, an attacker could construct a proof that passes verification for a transaction the network is supposed to reject. The team says internal and external human audits had already been completed, that AI-assisted review continues, and that the correction is scheduled for the V6 release rather than a patch to the live Alpha V5 network.

This is the second such finding in Aztec's public record this year. In March, the team disclosed a critical proving-system vulnerability in Alpha V4 that could have allowed theft of user funds, and it asked V4 users to withdraw before the V5 governance vote made the details public. The pattern is the reason the network is labeled Alpha: contributors treat it as a test surface where the value at risk stays deliberately limited compared with general-purpose rollups.

A soundness bug is a different risk class from a smart-contract exploit. Most optimistic rollups can fall back on re-execution by honest validators, which catches an invalid state transition. A validity proof system has no such backstop. If the verifier accepts a false proof, the chain treats an invalid transaction as final, and neither node operators nor users can spot the discrepancy from public data. That is why teams in this position disclose on their own schedule and time the details to an upgrade. It is also why Aztec's admission, that human audits missed what an automated review caught, matters to every zero-knowledge network shipping in production today.