Aztec Says Proving-System Flaw Leaves Alpha V5 Funds Exposed Until V6

Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system of its Alpha V5 release. The flaw lets an attacker construct a zero-knowledge proof that passes verification for a transaction the network should reject. Core contributors found it on July 27 through internal AI-assisted auditing. Aztec tells users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure until incident response is complete. The fix is planned for V6.

Aztec says reviewers have found no other high-severity or critical V5 issues, and that internal and external human audits are complete. The team had already published a disclosure for a critical vulnerability in Alpha V4. Two consecutive alpha releases have now had critical proving-layer defects.

A soundness bug of this kind is different from an ordinary smart-contract exploit. Most rollups rely on validators re-executing transactions as a fallback check. That check does not work when the proof itself is wrong, because the proof is what everyone relies on. On a privacy network the problem is worse. Transaction contents are hidden, so outside observers have fewer ways to notice that state has been altered.

Separately, Aztec published a post-quantum roadmap that aims for full migration by the end of 2030. The Defiant reports that the first deliverable, hardened developer libraries, is due in February 2027. Selection of new signature schemes follows in March 2027, public-key encryption in July 2027 and zero-knowledge proof systems in November 2027. Aztec says the final stage depends on changes to Ethereum's data-availability layer, which Aztec does not control.