Aztec discloses a critical V5 flaw that let forged zero-knowledge proofs pass verification, and builds the fix into its V6 upgrade

Aztec, the privacy-focused layer-2 (L2) network on Ethereum, has published a disclosure of a critical vulnerability in the V5 Alpha proving system. According to the disclosure, an attacker could build a proof that passes verification for a transaction the network should reject. If the network accepted such a proof, the transaction would produce a state change outside the rules V5 is meant to enforce. Core contributors say they found the flaw on July 27, 2026, through internal AI-assisted auditing.

Aztec's wording is blunt. The team says V5 funds, applications and contract state "should be treated as exposed to a protocol-level failure" until contributors finish incident response and operators complete the required network actions. The fix is part of the V6 release. V6 adds circuit updates that stop the network from accepting proofs tied to the affected proving system. Aztec says reviewers have found no other high-severity or critical V5 issues. Internal and external human audits are complete, and AI-assisted review is still running.

V6 is more than a patch. Reports on the governance process say the upgrade was approved and scheduled to execute on October 26. It is designed to stream Ethereum-to-Aztec messages into blocks as nodes see them. Aztec puts deposit and bridge latency at about 12 to 30 seconds under V6, down from the current 24 to 108 seconds. It also funds the V5 network for 30 days during migration. The Defiant noted that Aztec announced approval while its governance dashboard still showed voting as open. That timing matters for a network that markets itself as decentralized.

This is Aztec's second critical disclosure in one cycle. In June, the team told V4 users to withdraw before June 25 after separate flaws surfaced during the move to V5. In both cases, contributors found a defect under embargo, disclosed it only when the fix shipped in an upgrade, and followed up with a funded migration period. Aztec has also published its post-quantum design work and continues to market its Alpha network to builders. The V5 finding places Aztec's main security exposure in the proving system itself, not in the application code built on top of it.