Aztec discloses a proving-system flaw in Alpha V5 that could let invalid transactions pass verification

Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system of its Alpha V5 network. Core contributors found the flaw on July 27 through internal auditing assisted by artificial intelligence (AI). According to Aztec, an attacker could build a proof that passes verification for a transaction the network should reject. If accepted, that transaction could change the network's state in ways the V5 rules are meant to forbid.

This is a soundness defect, meaning the system can accept a false statement as true. It is a different kind of failure from a smart-contract bug. In a contract exploit, the chain runs bad code correctly and the damage is visible on-chain. In a soundness failure, the verifier itself certifies a state change that never followed the rules. Aztec says V5 funds, applications and contract state should be treated as exposed to a protocol-level failure. That holds until contributors finish their incident response and node operators take the required network actions.

The disclosure contains an unusual admission: contributors cannot determine whether anyone used the flaw before they found it. They wrote that the affected system does not record the information needed to separate ordinary accepted transactions from transactions accepted through the flawed proving path. On a privacy network, validators cannot re-execute private transactions, so they cannot check them after the fact. Re-execution is the safety check many rollups rely on, and here it is not available.

This is not Aztec's first such disclosure. The team previously disclosed a critical vulnerability in Alpha V4. Aztec says the V5 findings will shape the V6 release, including circuit updates that stop the network from accepting proofs tied to an affected proving system. More than two months passed between the July finding and the public write-up. That gap fits a pattern of embargoed disclosure timed to upgrades.