Aztec Network suffered an attack that resulted in losses exceeding $2.15 million, stemming from a mismatch between ZK proofs and L1 settlement boundaries.

According to Huoxun Finance, Aztec Network's RollupProcessorV3 contract suffered an attack, resulting in losses exceeding $2.15 million. The root cause of the vulnerability was that numRealTxs was not properly bound to the transaction set enforced by ZK proofs, causing a discrepancy between the proof verification path and the L1 settlement logic's interpretation of the transaction list. Attackers exploited this vulnerability to transfer real deposits to slots not processed by the settlement logic, bypassing the decreasePendingDepositBalance() function, creating unsecured private balances out of thin air, and then withdrawing them through the normal settlement process. This affected seven types of assets.