← The Polylog Crypto Intelligence Brief.jpg)
Morning Edition · Thursday, October 15, 2026Published at 1:43 AM EDT · New York
Aztec Discloses a Critical Proof Flaw in Its V5 Alpha as Miden Pitches Private Stablecoin Finance
Aztec contributors found a flaw that could let a forged proof pass verification, discovered it on July 27 with AI-assisted auditing, and will not ship the fix until the V6 upgrade later this year.
Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system of its V5 Alpha. According to the team, an attacker may be able to build a proof that passes verification for a transaction the network should reject. If the network accepted such a proof, the result would be a state change outside the rules V5 is meant to enforce. Core contributors found the flaw on July 27 through internal AI-assisted auditing. The fix is planned for V6, which will include circuit updates that stop the network from accepting proofs tied to the affected proving system. Aztec says reviewers have found no other high-severity or critical issues in V5.
This is the second critical disclosure during Aztec's alpha phase. In June, the team told V4 users to withdraw before June 25, as the V5 upgrade exposed security flaws. V5 added a full private execution environment. Aztec has also limited its exposure directly: its revived private payments wallet caps every transfer below $2,500.
This class of bug matters more on a privacy chain than elsewhere. On a transparent rollup, validators can re-execute transactions as a backstop. On Aztec, private execution happens on the user's own device, and the network sees only the proof, so validators have nothing to re-execute. A soundness flaw in that setting defeats the main check the system has.
Miden, the privacy network spun out of Polygon, is making the commercial case for confidential execution at the same time. Its PriFi stack pairs stablecoins with privacy infrastructure aimed at payroll, treasury, supplier payments and lending. Miden argues that public ledgers expose activity that no business would want to run in the open. The company has also launched Bread, a self-custodial private wallet for sending, receiving and swapping. Earning and cross-chain features are listed as coming soon.
What this means
Privacy layer-2 networks are asking institutions to trust a proof that no one else can independently re-check. Aztec's disclosure shows that the proof itself can be the failure point. The parties exposed are depositors on alpha-stage privacy networks and the institutions Miden and Aztec are courting. A soundness bug creates a hidden-inflation or theft risk that outside observers cannot audit after the fact. Aztec found this bug itself and disclosed it on a schedule tied to its next upgrade, which matches a pattern the desk has tracked elsewhere, and the transfer caps limited the possible damage. Zcash is the clearest precedent: it quietly fixed a counterfeiting flaw in its original Sprout proving system in 2018 and disclosed it in early 2019. Its response afterward was to add independent supply checks rather than abandon privacy. Many treat privacy layer-2 networks as ready for institutional payments. The desk's read is that institutions will first require supply-integrity checks, transfer caps, and more than one independent proof system. The likelier outcome over the next three to six months is that institutional privacy pilots stay capped and permissioned while V6 and similar upgrades ship. A clean audit of Aztec's V6 circuits followed by higher caps would prove that read wrong. A second soundness disclosure in V6 would push institutional demand toward privacy run by known operators, such as permissioned pools.
Part of a tracked trend
Proving-System Bugs Become a Distinct Rollup Risk
Soundness defects in zero-knowledge proving systems will keep surfacing as a risk class separate from smart-contract exploits, because validator re-execution — the fallback most rollups rely on — cannot catch them, forcing teams into embargoed disclosure timed to upgrades and pushing users toward proof-system diversity and escape hatches.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Ledger Finds Hidden Cellular Chip That Sent Recovery Phrases From Reseller-Sold Wallets
- Solana Schedules Alpenglow Consensus Switch for October 21, Targeting Finality in About 150 Milliseconds
- European Banking Authority Names Circle's USDC the First Significant Stablecoin Under MiCA
- NEAR Intents Custody Bug Leads Wave of Exploits Hitting Hot Wallets, Signers and Oracles
- Higher-Than-Expected US Inflation Data Drives Nearly $1 Billion in Crypto Liquidations as Bitcoin Falls Below $81,000
- Ethereum Researcher Proposes Splitting Block Execution Proofs So Proving Can Begin Before State Is Known
- Russia's Central Bank Authorizes Sberbank to Exchange Crypto as Banks in Russia, the UAE and Europe Absorb Retail Access
Comments
0No comments yet.