Aztec Tierra Fixes Critical V5 Flaw, Doubles Proof Speed

Aztec Tierra cuts private proof times

The Foundation’s launch announcement reports one-second client-side proofs on a native device. It also says Ethereum-to-Aztec messages can arrive in as little as 12 seconds, compared with a previous average of two minutes.

That comparison uses a new minimum against an old average. It does not establish that every deposit completes ten times faster. Proof generation, message delivery and final settlement are separate stages, so a one-second proof should not be read as one-second Ethereum finality.

Aztec’s network overview describes an Ethereum rollup in which users generate proofs locally, sequencers order transactions and provers produce epoch proofs. Ethereum verifies the resulting proof; private inputs are not published in clear text.

The distinction explains the upgrade’s practical target. A private application has to prepare evidence that a transaction follows its rules without exposing the underlying inputs. Cutting that preparation time can reduce waiting at the user’s device, while subsequent network work still has to finish.

The release includes AI-assisted security testing and formal verification of core cryptographic components, according to the Foundation. Neither measure establishes that all application code is free of bugs. The release’s Alpha designation remains relevant even after the known vulnerability is closed.

V5 exploitation remains unquantifiable

Aztec’s August 7 disclosure said contributors found the flaw on July 27 through internal AI-assisted auditing. It warned that funds, applications and contract state were exposed.

The problem could allow a proof to pass verification for a transaction that should be rejected. In plain terms, checking a proof would no longer reliably establish that the transaction obeyed the network’s intended rules.

The disclosure also identified an investigative limit: accepted transactions did not contain enough information to distinguish legitimate activity from use of the flawed proving path. A visible absence of suspicious transfers therefore cannot establish that exploitation never happened. The public record supports an unknown historical impact, rather than a zero-loss conclusion.

Those concerns are separate from the June thefts involving deprecated Aztec contracts. Aztec Labs’ Aztec 2.0 incident report puts that old rollup’s principal drain at approximately $2.2 million across three transactions, followed by a smaller residual sweep. It explicitly separates those contracts from the live network.

Blockaid’s analysis of Aztec Connect reports approximately $2.19 million extracted in the initial June attack and about $88,000 in a subsequent residual-value attack. Those are observed legacy-contract losses, with transaction evidence linked in the report, and must not be counted as V5 losses or new November thefts.

Tierra migration keeps Alpha risks visible

The status page lists Tierra as the current release and reports no active notices. It separately preserves the warning for V5, directing funds and applications away from the affected version. Resolution in the new release does not establish that an older deployment has become safe without migration.

For application teams, that makes version identification a concrete operational question. A familiar project name is insufficient: users need to know which network version and application deployment handle their funds. The reviewed notices do not give a consolidated count of migrated wallets or applications.

Aztec’s smart-contract documentation allows developers to combine public and private functions within one contract. Private functions execute on a user’s device, while public functions execute on the network. Applications decide which information their public calls and outputs reveal.

That flexibility also puts application design alongside protocol security. A correct proof system cannot make information private if an application deliberately publishes it. Similar distinctions between spending authority and disclosed data appear in Zcash’s proposed viewing-key changes, although that proposal addresses a different network and threat.

Market sentiment remained cautious: Alternative.me’s index stood at 26, or Fear, versus 37 a day earlier. That reading measures broader sentiment, not Aztec’s solvency or the security of an individual deployment.

The next checks are application-specific migration notices and further security disclosures. Tierra closes a named protocol flaw according to Aztec, but the reviewed evidence leaves historical V5 impact unknown and the network’s Alpha status intact.