# Critical Vulnerability in Alpha v4

Canonical: https://aztec.network/blog/critical-vulnerability-in-alpha-v4  
Type: Article  
Reviewed: 19 October 2026  
Publisher: Aztec Foundation

Author: Innokentii Sennovskii  
Published: 27 March 2026  
Category: Aztec Network

On Wednesday 17 March 2026 our team discovered a new vulnerability in the Aztec Network. Following the analysis, the vulnerability has been confirmed as a critical vulnerability in accordance with our vulnerability matrix.

![](/api/media/file/blog-a282fcfd2e-6b428cae-1600x583.webp)

The vulnerability affects the proving system as a whole, and is not mitigated via public re-execution by the committee of validators. Exploitation can lead to severe disruption of the protocol and theft of user funds.

In accordance with [our policy](/blog/alpha-network-security-what-to-expect), fixes for the network will be packaged and distributed with the “v5” release of the network, currently planned for July 2026.

The actual bug and corresponding patch will not be publicly disclosed until “v5.”

Aztec applications and portals bridging assets from Layer 1s should warn users about the security guarantees of Alpha, in particular, reminding users not to put in funds they are not willing to lose. Portals or applications may add additional security measures or training wheels specific to their application or use case.

## **State of Alpha security**

We will shortly establish a [bug tracker](https://github.com/AztecProtocol/aztec-packages/blob/next/SECURITY.md) to show the number and severity of bugs known to us in v4. The tracker will be updated as audits and security researchers discover issues. Each new alpha release will get its own tracker. This will allow developers and users to judge for themselves how they are willing to use the network, and we will use the tracker as a primary determinant for whether the network is ready for a "Beta" label.

## **Additional bug disclosure**

We have identified a vulnerability in barretenberg allowing inclusion of incorrect proofs in the Aztec Network mempool, and ask all nodes to upgrade to versions v.4.1.2 or later.

We’d like to thank Consensys Diligence & TU Vienna for a recent discovery of a separate vulnerability in barretenberg categorized as medium for the network and critical for Noir:

- Sebastian Watzinger (TU Wien):[https://x.com/seb_watzinger](https://x.com/seb_watzinger)
- Christoph Hochrainer (TU Wien):[https://x.com/hochra1ner](https://x.com/hochra1ner)
- Valentin Wüstholz (Consensys Diligence):[https://x.com/vwuestholz](https://x.com/vwuestholz)
- Maria Christakis (TU Wien):[https://x.com/mchri5taki5](https://x.com/mchri5taki5)

We have published a [fixed version of barretenberg](https://github.com/AztecProtocol/aztec-packages/releases/tag/v5.0.0-nightly.20260324).

We’d also like to thank [Plainshift AI](https://x.com/plainshift) for discovery, reproduction, and reporting of one more vulnerability in the Aztec Network and their ongoing work to help secure the network.

---

Markdown representation of https://aztec.network/blog/critical-vulnerability-in-alpha-v4. Published by Aztec Foundation.