Aztec discloses a proving flaw in its Alpha V5 network that could let forged transactions pass verification

Aztec, the privacy-focused rollup on Ethereum, has disclosed a critical soundness vulnerability in the proving system of its V5 Alpha network. A soundness flaw means the system can accept a proof of something false. According to Aztec, an attacker could build a proof that passes verification for a transaction the network should reject. That transaction could then produce a state change outside the rules V5 is meant to enforce.

Core contributors say they found the flaw on July 27, 2026, through internal AI-assisted auditing. They delayed public disclosure until a fix was scheduled for the next release, V6. V6 will include circuit updates that stop the network from accepting proofs tied to the affected proving system. Aztec says reviewers have found no other high-severity or critical V5 issues so far.

The most important admission concerns the past. Aztec states that it cannot determine whether anyone exploited the flaw before it was found. The affected system does not record enough information to tell a normally accepted transaction from one accepted through the faulty proving path. Historical chain data therefore cannot show whether exploitation occurred or how large any damage was. Contributors are working with node operators, application teams and bridge operators, who are adding security guards around affected flows until V6 ships.

This is not Aztec's first such disclosure. The team previously published a critical vulnerability in Alpha v4, and it raised its total bug bounty to $2 million. In a privacy rollup, the network hides transaction contents by design. Other validators cannot re-execute private transactions to check them, so the proof is the only thing standing between users and an invalid state change. Aztec has also published how fees and gas work on the network as it moves toward a token-backed mainnet. A soundness bug there would affect real economic value rather than test balances.