Aztec V1 exploit analysis

Aztec's V1 rollup exposes escapeHatch(proofData, signatures, viewingKeys), a permissionless emergency exit that accepts a TurboVerifier-validated rollup proof and pays the encoded withdrawal. The attacker submitted rollup proofs that the on-chain TurboVerifier accepted yet that authorised withdrawing the rollup's entire pooled ETH, DAI, and renBTC balances to an address with no matching deposit, breaking the rollup's value-conservation invariant.

The attacker EOA 0x6952d9246e9afe8b887b2877225163436f78e97f called escapeHatch directly. The drain tx for the ETH leg is 0xab306cd2184d23b6ba3e151b10b3b9a0b81f211cc16f4f3b0c79f0b17a59c2b5 on Etherscan; the DAI leg is in 0x5c196c37a109d74c9797254287a0331f30e0daa637af241bd28fdc43774705c3 and the renBTC leg is in 0x9e1d6ab7c20ae235409d7dd3a9cd47c04f07293585b3498b8beed82d6f6b03ca.

DeFiHackLabs reports a total loss of about $2.2M, comprising 1,158 ETH plus 150,000 DAI plus 0.4696 renBTC.

This is a cryptographic-break capture, not a permission or accounting error; the vulnerability reading is from DeFiHackLabs' reproduction note and the Aztec Connect V3 incident post-mortem on cryptotimes.io. The contract deployment is unverified.

What would have prevented it: a escapeHatch that requires the encoded withdrawal's nullifier to be already spent against an on-chain deposit, or any server-side circuit check beyond proof verification that is not captured by the on-chain verifier.