Aztec discloses a proving-system flaw that could let invalid transactions pass verification on its Alpha V5 network

Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system of its Alpha V5 network. The proving system is the component that checks cryptographic proofs that a transaction is valid. An attacker could build a proof that passes verification for a transaction the network should reject. If the network accepted such a transaction, it could change state (the record of balances and contract data) outside the rules that V5 is meant to enforce.

Core contributors found the flaw on July 27, 2026, through internal AI-assisted auditing. The disclosure came weeks later. Aztec says it cannot determine whether anyone exploited the flaw before it was found. The affected system does not record enough information to tell normal transactions apart from transactions accepted through the flawed proving path. The team says V5 funds, applications and contract state should be treated as exposed to a protocol-level failure until incident response is complete and operators carry out the required network actions.

The fix will come in V6. That release will include circuit updates (changes to the proof-system circuits) that stop the network from accepting proofs tied to an affected proving system. L2BEAT's project page now lists the known critical proving-system vulnerability as a risk to funds.

This is not the first such disclosure on Aztec's alpha network. The team previously published a critical vulnerability in Alpha V4. A soundness bug (one that lets invalid proofs pass as valid) differs from an ordinary smart-contract exploit. In a validity rollup, the verifier is the final check, and validators do not re-execute private transactions they cannot see. On a privacy network, a forged proof could create or move value without any public record that an outside party could audit afterward.