Aztec Discloses Critical Proving-System Flaw in Its Alpha V5 Privacy Network

Aztec, the privacy-focused layer-2 network on Ethereum, has disclosed a critical vulnerability in the proving system behind its Alpha V5 release. Core contributors say the defect could let an attacker build a proof that passes verification for a transaction the network should have rejected, and that funds, applications and contract state on V5 should be treated as exposed to a protocol-level failure until operators complete the required network actions. The disclosure states that the fix is planned for the V6 release and that the finding came out of internal auditing assisted by artificial intelligence tools, after internal and external human audits had already been completed.

This is a soundness bug, a different class of problem from the smart-contract exploits that dominate loss tables. A soundness defect does not require a buggy application. It breaks the guarantee that the verifier only accepts statements that are true, an assumption every contract on the chain inherits. Aztec has been through this before. It told V4 users to withdraw ahead of the V5 upgrade after an earlier critical finding.

The structural problem for privacy chains is that the usual fallback does not apply. Optimistic rollups and many validity rollups rely on node re-execution or fraud windows as a backstop. On a network where execution happens on the user's own device and the chain sees only a commitment, no independent party can re-run the transaction and notice that the arithmetic was wrong. The proof is the only check.

Aztec's framing is that Alpha exists precisely to surface findings like this before wider deployment, a defensible position for a network still labeled alpha. The counterpoint is that users who bridged real value into V5 carried the risk of an unproven verifier with no compensating mechanism, and that the disclosure and the fix are separated by a full release cycle.