← The Polylog Crypto Intelligence Brief
Morning Edition · Monday, September 28, 2026Published at 1:43 AM EDT · New York
Aztec Discloses a Critical Soundness Flaw in Its Alpha V5 Proving System
Core contributors found the defect through internal AI-assisted auditing and say a crafted proof could pass verification for a transaction the network should reject, with the fix deferred to V6.
Aztec, the privacy-focused layer-2 network on Ethereum, published a disclosure describing a critical vulnerability in the proving system behind its Alpha V5 network. Core contributors identified it on 27 July 2026 through internal auditing assisted by artificial intelligence models. The defect would allow an attacker to construct a proof that passes verification for a transaction the protocol should reject, which puts V5 funds, applications and contract state at risk. The team says the repair ships with V6.
This is a soundness failure, not a smart-contract bug. On a network where execution is private and correctness is asserted by a proof, there is no set of validators re-running the transaction to notice that it was invalid. That distinction is why proving-system defects have to be handled with embargoed disclosure timed to an upgrade, and it is the second such finding for the network after a critical flaw in Alpha v4 was disclosed earlier in the year.
The disclosure comes as privacy-focused networks seek institutional adoption. Miden, another zero-knowledge network, is marketing a stack for confidential but verifiable and compliant finance with client-side proof generation and local account state. Both projects argue that confidentiality is a prerequisite for serious on-chain settlement, which makes the reliability of their proof systems central to that argument.
Veracity: Corroborated
84/100- If true, who benefits
Aztec, which converts a protocol-level failure into evidence that its alpha process and AI-assisted auditing work, and formal-methods auditors and rival zero-knowledge teams such as Miden that can now sell proof diversity to institutions.
- The nuance
The disclosure is authentic and specific, and it follows an , but every material fact comes from Aztec alone, the team says it cannot determine whether anyone exploited the defect before it was found, and no outside party has reviewed the severity claim or the decision to defer the fix to V6.
Part of a tracked trend
Proving-System Bugs Become a Distinct Rollup Risk
Soundness defects in zero-knowledge proving systems will keep surfacing as a risk class separate from smart-contract exploits, because validator re-execution — the fallback most rollups rely on — cannot catch them, forcing teams into embargoed disclosure timed to upgrades and pushing users toward proof-system diversity and escape hatches.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Zano Rewinds Its Blockchain One Month After Gateway Flaw Minted Unauthorized Coins
- Buterin Says Hegotá Will Be Ethereum's Last Familiar Fork Before a Cryptographic Rebuild
- US Prosecutors Seize $84.2 Million From a Tether Payment Conduit, and the Reserve Question Stays Open
- US Crypto Rulemaking Falls Back to States as the Clarity Act Collapses
- Bitcoin Trades Below $84,000 as Brent Passes $106 on the Hormuz Standoff
- Aave Lets Borrowers Post Coinbase Stock Tokens While Equity Markets Are Shut
- Three New Exploit Reproductions Land in the DeFiHackLabs Feed, All From Trusted Inputs
Comments
0No comments yet.