Post-mortem, 12 October 2026

SummaryCopy Anchor Link

On 12 October 2026 at 11:18:09 UTC, transaction 0xccccd5a8117a27beae11b2ff8361bcc0c496f14a65d0481dedd6965044fb1a42 (block 86632174) emptied the ZeroTrace vault (0xf3935bec6247170B28e1755c85957A72f243D84D) on Robinhood Chain. An address that had never used the vault, 0xf7a504450ec997c264338b4bff0eb4199d964a24, submitted a zero-knowledge proof claiming to spend two notes worth the vault's entire share supply. The vault released 90,422,336 ZERO, which were sold for 4.670 ETH.

The proof should never have been accepted. It proves a statement that cannot be true, and the vault accepted it because the proof system's verifier, generated by Aztec's Barretenberg, had a soundness flaw: it could be made to accept proofs of false statements.

Aztec found and fixed that flaw on 14 May 2026. They published no security advisory for it, did not mention it in their release notes, and left their official installer pointing to a build without the fix. That installer still installs the vulnerable build today. The same flaw was used on 24 September to take 1.9 million USDC from Payy.

Our contracts, our circuit and the vault's accounting worked as designed. Entries to the vault are closed, and a new vault with a corrected verifier was deployed on 12 October 2026 at 22:36 UTC. Every note that was unspent in the emptied vault is refunded in full, into a note of the new vault.

What happenedCopy Anchor Link

A ZeroTrace vault holds ZERO and a Merkle tree of private notes. Spending a note requires a zero-knowledge proof that the note exists, belongs to the spender and has not been spent, and that the value going in equals the value going out. The vault checks that proof with a verifier contract generated by Barretenberg, Aztec's proving system for the Noir language.

The transaction called the vault's router to sell, with a proof that two notes were being spent and that together they covered all 20,520,873,138,048,082,021,922,500,621,968 shares in existence. That is impossible: part of the share supply is a locked seed note that nobody can spend, so no set of real notes can add up to it. The verifier accepted the proof anyway. The vault paid out its entire backing, the router sold it, and the ETH went to the sender.

Root cause: a soundness flaw in Aztec's BarretenbergCopy Anchor Link

UltraHonk, the proof system Barretenberg uses, has a zero-knowledge mode in which part of the proof is checked through a sub-protocol called the small-subgroup inner-product argument. That argument is only sound if the verifier checks, as a separate condition, that a running sum starts at zero. Barretenberg's verifier did not. It checked a single combined equation, which, in Aztec's own description of the fix, left the prover one degree of freedom: enough to make a false proof verify.

Aztec corrected this on 14 May 2026 in commit 58bf73a of AztecProtocol/aztec-packages, titled "fix!: small subgroup ipa bug". The corrected verifier checks the missing condition as a fifth opening claim. The verifier deployed for ZeroTrace has the uncorrected form, with four.

How the vulnerable build reached usCopy Anchor Link

Noir and Barretenberg are released separately, and their versions must match. Aztec's official installer, bbup, chooses the Barretenberg build from a compatibility table published in Aztec's repository, keyed by the installed Noir version.

• The installer selects the vulnerable build. For Noir 1.0.0-beta.22, the most recent Noir release with an entry in Aztec's table when we built our verifier, bbup installs Barretenberg 5.0.0-nightly.20260522. That build was made eight days after Aztec's fix, from a branch that did not contain it.
• Aztec added that entry after fixing the flaw. The mapping was added to the table on 1 June 2026, two weeks after the fix, and has never been updated. On 13 October 2026, the installer still installs the vulnerable build for Noir beta.22. No later Noir release has an entry at all.
• No advisory. Aztec has published no security advisory for this flaw. On 8 October 2026 they published two advisories for a different verifier bug, and none for this one, two weeks after it had been used against Payy.
• No mention in the release notes. The fix first shipped in Barretenberg v5.0.0 on 13 July 2026. Its release notes have a section on security hardening listing six themes; this flaw is not among them. The only public trace is a commit message.
• No warning in the installer. bbup has a mechanism to warn about Barretenberg versions with known soundness issues. It covers only versions before 0.82.

A project following Aztec's documented installation path with Noir beta.22 received a verifier that accepts forged proofs, with no advisory, release note or warning to tell it otherwise. That is what happened to us.

What is establishedCopy Anchor Link

What is inferredCopy Anchor Link

That the attacker used this particular flaw is inferred, not reproduced. Every other component checks out, the proof is valid for a statement that cannot be true, and this flaw produces exactly that result. It had been used the same way against Payy eighteen days earlier.

What it was notCopy Anchor Link

• Not a stolen key, and not our team, front end, RPC or relayer: the attacker needed none of them.
• Not a replayed or altered transaction: the proof is bound to its inputs and to the vault.
• Not a flaw in our circuit, our contracts or the vault's accounting.

Timeline (UTC)Copy Anchor Link

ImpactCopy Anchor Link

• 90,422,336 ZERO, the full backing of every note in the vault, were released and sold for 4.670 ETH, sent to 0xf7a504450ec997c264338b4bff0eb4199d964a24.
• Every note held in the vault at block 86632174 lost its value. The vault had received 63 deposits from 28 addresses. Every one of those notes is refunded in full: see Refund of the earlier vault.

What we have doneCopy Anchor Link

The new vault is deployed (0xEE92d20c1b0AAA686DDc8809A1B6A67aB092eb33); the wallet will reopen on it.

• A verifier with Aztec's fix. It is generated with Barretenberg 5.2.1, the latest stable release, and the Noir version Aztec builds it with. It contains the missing check.
• No reliance on Aztec's installer. Both tools are pinned to exact versions, downloaded from their official releases and checked against their published checksums. Barretenberg is a stable release, never a development build; Noir has no stable release yet, so we use the version Aztec builds Barretenberg 5.2.1 with.
• Checks on the generated verifier. The build stops, and the tests fail, if the verifier lacks the check Aztec added. Before deployment, the new verifier must also accept a real proof.
• A vault that can be stopped and repaired. The new vault can be paused, stopping every spend of a note, and its verifier can be replaced without moving any note, should Barretenberg ever need another fix. Pausing and upgrading are separate roles, and each is a public on-chain transaction.
• A refund of every note, in full. Every note that was unspent in the emptied vault at block 86632173, the last block before it was emptied, is refunded what it was worth then, to the wei: 90,409,186.61 ZERO in all, funded by ZeroTrace. A refund contract checks each claim with the corrected verifier against the vault's note tree as it was at that block, pays each note once into a private note of the new vault, and pays the gas. The app refunds a wallet's notes automatically when privacy is turned on. There is no deadline. See Refund of the earlier vault.
• Tests. Contract, circuit and SDK tests, and end-to-end tests with real proofs on a fork of Robinhood Chain.

AppendixCopy Anchor Link

Sources:

• Aztec, commit 58bf73a, "fix!: small subgroup ipa bug"
• Aztec, Barretenberg v5.0.0 release notes
• Aztec, security advisories
• Aztec, bbup compatibility table
• Certora, "The Payy Exploit: A $1.92M Forged ZK Proof Attack"