github AztecProtocol/aztec-packages v6.0.0
on GitHub

2 hours ago
   v5   L1 ▕░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▏ L2    24–108s
   v6   L1 ▕████████▏ L2                          12–30s

                   A Z T E C  ·  6 · 0 · 0

Date: 2026-10-22 · Tag: v6.0.0 · Baseline: v5.2.1 · Major release

npm: @aztec-foundation/bb.js@6.0.0 (note the new @aztec-foundation scope) · crates.io: barretenberg-rs 6.0.0 · Noir: v1.0.0-rc.3

Summary

v6.0.0 is the protocol, proving system and L1 contracts behind the v6 rollup proposed in AZUP-3. It is a major protocol upgrade: new circuits, a new verification key tree and a new rollup deployment from genesis.

The headline change is the Fast Inbox (AZIP-22). L1-to-L2 messages now stream into L2 blocks as nodes see them on L1, instead of waiting for an Inbox tree to seal and a two-checkpoint lag, cutting message latency from 24–108 seconds to about 12–30 seconds. It reaches every layer: a rolling-hash Inbox on L1, per-block message bundles and a single variable-size parity proof in the circuits.

Alongside it: a transaction effects tree in every block header, a new protocol nullifier, a v3 contract address domain separator, a large round of proving system hardening (much of it developed privately and published with this release), Barretenberg performance work, Noir 1.0.0 release candidates, and L1 changes for fees, rewards, provers and staking providers.

This release is aimed at people working on the protocol, the proving system and the L1 contracts. Node operators and application developers should read the aztec-node v6.0.0 release notes instead.

What's in AZUP-3

v6 implements the following AZIPs. AZIP-33 and AZIP-34 are carried out by the upgrade payload rather than by contract code.

AZIP Change Where
22 Fast Inbox L1-to-L2 messages stream into blocks as nodes observe them L1 Inbox, rollup circuits (a703815)
23 Protocol Fee Margin Governance-set margin on the mana base fee, paid to a governance-set recipient. Launches at zero Rollup (f56ff4a)
24 First Prover Attribution The rollup records which prover first proved each checkpoint Rollup (#25389)
25 Full Epoch Activity Score A prover's activity score only increases on a full-epoch proof Rollup (d0c3996)
26 Transaction Effects Tree Each block header commits to a tree of its transactions' effects Circuits, L1 (ae2aace)
27 Rate-limited Provider Exits Attesters can exit their own positions, up to about 5% of the set per governance withdrawal delay Rollup staking (#25492)
29 Protocol Nullifier Refinement The protocol nullifier is derived from (origin, chain_id, version, salt) Private kernels (#25515)
30 90% Sequencer Reward Share The sequencer share of each checkpoint reward rises from 70% to 90% Deploy configuration (#25601)
31 Pluggable Sequencer Reward Calculator Governance can point the rollup at a reward calculator contract. Launches with none set Rollup (#25571)
33 Proof-of-Possession Gas Cap The payload raises the GSE's BLS proof-of-possession cap from 250,000 to 300,000 gas Upgrade payload
34 Sustain v5 After v6 The payload earmarks 1,800,000 AZTEC for v5 and cuts its checkpoint reward to 50 AZTEC Upgrade payload
35 Glamsterdam Gas Constants L1 gas per checkpoint 300,000 → 500,000; per epoch proof 3,600,000 → 4,000,000 Fee model (#25509)

Breaking changes

  • The foundation npm packages moved to the @aztec-foundation scope (#25328): bb.js, bb, bb-avm, bb-avm-sim, cdb, wsdb, ipc-runtime, the noir-* packages, l1-artifacts, constants-codegen and the protocol artifacts packages. The @aztec scope keeps what was already published. 

    -import { Barretenberg } from '@aztec/bb.js';
+import { Barretenberg } from '@aztec-foundation/bb.js';

  • Every verification key changes. New circuits, new flavors and new transcript rules (below) mean v5 proofs and VKs do not verify under v6, and the VK tree root is new.

  • Fiat-Shamir challenges are full-width by default (a69ffdf). Challenges are no longer truncated, so transcripts, proofs and VKs from earlier versions are incompatible.

  • Every contract address changes. The contract address domain separator is bumped to V3 (#25521), so the same class, salt, initialization and keys derive a different address than in v5. An address can never be live on two rollups. Protocol contracts keep their magic addresses.

  • Block headers gain a transaction effects tree root (ae2aace). Header serialization grows by one field, so every transaction hash, VK, artifact and canonical address changes with it.

  • The protocol nullifier is derived from the tx request's salt alone (#25515). Two requests with the same origin and salt are mutually exclusive, and the siloed protocol_nullifier replaces tx_request_salt in the private call inputs.

  • MAX_APPS_PER_KERNEL rises from 3 to 5 (910504d), and kernels use custom arithmetic gates (b7433c0).

  • The AVM's Poseidon2 permutation is re-optimised (ce692ca), and the AVM now has at most 4 registers (9b3753f).

Proving system (Barretenberg)

Chonk (client IVC)

  • Per-kind circuit flavors. Apps and kernels now have their own flavors, MegaApp and MegaKernel (ff378cb), with a CircuitKind carried from the PXE through bb.js and bbapi. Protocol VKs are computed per kind at the source, replacing --use_zk_flavor.
  • One multilinear-batching sumcheck per kernel (635a9cf).
  • Custom arithmetic gates for kernels (b7433c0), and room for 5 apps per kernel instead of 3 (910504d).
  • ROM tables via logup (d3e42f9).
  • Cheaper Poseidon2: two fewer rows per permutation (f14df1d) and batched sponge absorbs (f7b101b).

PCS, IPA and the Grumpkin side

  • TripleIPA for the ECCVM (bcb979d), with fused IPA folds and a short-scalar IPA SRS fold.
  • A sparse ZK masking polynomial in Shplemini (1a42ab0), and Libra masking with L = 4 on Grumpkin (19052d3).
  • ECCVM and Translator sumcheck optimizations (#23615), plus general sumcheck round and relation evaluation speed-ups.
  • The Grumpkin SRS is anchored to pinned chunk hashes on load (#23587).

Performance

  • A rewritten Pippenger MSM (3c7386e) and Booth-sliced element MSMs (#23691).
  • WASM SIMD throughout the prover: a 5-wide VectorField primitive, Montgomery multiplication, row-parallel sumcheck univariates, and SIMD Gemini folds and partially_evaluate.
  • Faster circuit construction (398a5e6): arithmetic, tiled gate storage and containers.

AVM

  • A specialized MegaAVM flavor (a32b5b8), per-column public-input sizes in the recursive verifier, and granular destination selectors for precomputed subtraces.
  • The TypeScript AVM simulator is gone. Simulation runs in the native bb-avm-sim service over generated IPC bindings (96082e3), alongside a wsdb world-state service and the new ipc-runtime.
  • Fixes from the Honk audit (2c6023a).

Soundness and security hardening

A large set of proving system and circuit fixes was developed in a private branch while the v6 circuits were being finalized. It is public with this release, and the mainnet v6 verifier and VK tree are built from it. Each item below links the commit.

Verifier and transcript strictness

  • Recursive pairing accumulators with a mixed point at infinity are rejected (3763de6). This is the v6 counterpart of GHSA-2hc8-mq24-76v2 (high) and GHSA-73xc-j27q-wg75 (medium), both fixed for v5 in v5.2.1.
  • PCS pairing points at infinity fail verification (5b16bcd) rather than being accepted or aborting.
  • Verifiers consume each proof segment exactly (cd61020), and native verifiers reject trailing data after a proof (94581fe).
  • Pairing points are aggregated with short scalar multiplications on Ultra (2b0c0b4).
  • IPA challenge handling is tightened (1b33386), and verifier and prover validation strengthened across flavors (74cbbff).
  • Flavor selectors must be compatible with their relations (6bbfc20).

Constraint fixes

  • ECCVM: scalar limbs and first-row translation values are now constrained (3472adc); queue reconstruction and IPA inputs are validated (8c9f71b); MSM constraints are updated (224b033).
  • Translator: boundary constraints updated (d3020cb).
  • Databus: constraints strengthened (08f20ae).
  • Batch merge: accumulator boundaries validated (d2469f2).
  • Chonk: proof boundaries (6d7fd08) and the proving and mock-verification paths hardened (80e6dca).
  • Constant-point MSMs: validation strengthened (dfa66b7).

Input validation

  • Serialization, SRS and crypto inputs are validated before use (e8a1119), and msgpack errors and SRS size are checked before allocation (#25487).
  • FieldSponge is bound to the permutation's state width (ca59e1c).

Protocol circuits

  • Kernels: stricter tail array validation (bec1093); claimed lengths asserted against array capacity in the tail's dense, trimmed and sorted helpers (87b10ed); claimed_revertible_counter bounded in the init circuit (26f3e5c); scoped metadata preserved through reset (6088fa8); zero-valued settled read requests rejected (9929a81).
  • A surviving nullifier link may only resolve to a non-revertible note hash (#25579).
  • Rollup: private log padding validated (b8cfcc1); blob points must be canonically encoded (7e6ff7b); contract class log lengths must be canonical (1815fd5).
  • Serialization: Option must be canonically serialized (41ecf22), and BoundedVec lengths are validated in protocol serde (cda1c77).
  • Bigcurve and bignum fixes, with their tests now running in CI (e078f15).
  • AVM simulator: hashmap keys hash the full u128 (f5d6874).

Protocol circuits

  • Fast Inbox circuits. L1-to-L2 messages arrive in per-block bundles (a6f0cc5), proven by a single variable-size InboxParity proof per checkpoint (420d574), with variants for sizes 4 and 16. Non-first blocks can consume messages from the same block (94c4a8e), and a new block_root_msgs_only_rollup circuit handles blocks with messages but no transactions (6847d80). Blocks per checkpoint are capped, empty blocks are allowed anywhere, and the block-root variants are merged (f341571).
  • The Inbox rolling-hash chain is domain-separated (a96bcfd).
  • Transaction effects tree (ae2aace): one leaf per transaction, binding its hash to a structured hash of its effects. A block header alone now proves inclusion and exact effects with a short membership proof.
  • Protocol contracts call the protocol oracles (#25526), and their registration nullifiers are seeded at genesis (#25497).
  • The teardown call's AVM startup gas is charged (#25536).
  • Blob fractions are derived by halving the roots of unity (070b810).
  • poseidon2_hash_bytes does not commit to the byte length, now documented (#25566). Callers that need length binding must add it themselves.
  • The protocol artifacts are published to npm (#25075), and constants are generated by a standalone constants-codegen package.

Noir

  • Noir moves from v1.0.0-beta.25 to v1.0.0-rc.3, the first Noir 1.0 release candidates (#25511).
  • noir-lang/poseidon is now v0.4.0.
  • Circuits execute with noir-execute. The standalone acvm binary is no longer shipped.

L1 contracts

Fast Inbox (AZIP-22)

  • The Inbox keeps rolling-hash buckets alongside its frontier trees (d627406), and consensus moves to the streaming Inbox (a703815).
  • Buckets are evicted only after their messages are consumed by a proven checkpoint (455099a).
  • The censorship cutoff is derived from the configured Ethereum slot duration.
  • MessageSent emits the full message, and getState returns the Inbox's full live position.

Proofs and provers

  • Epoch proofs verify only new headers (#25404), submitProof takes only the new headers (#25419), and full-epoch proof overhead is reduced (#25406, #25386).
  • Early proof submission can no longer be used to grief other provers (#25582).
  • First prover attribution (AZIP-24, #25389) and a full-epoch-only activity score (AZIP-25).

Fees and rewards

  • Protocol fee margin (AZIP-23): a governance-set margin and recipient on the mana base fee, launching at zero.
  • Pluggable sequencer reward calculator (AZIP-31, #25571). A calculator that reverts or misbehaves falls back to the default reward and never blocks a proof.
  • Glamsterdam gas constants (AZIP-35, #25509), and a 90/10 sequencer/prover reward split (AZIP-30).

Staking

  • Rate-limited attester-initiated exits (AZIP-27, #25492). An attester, or a relayer carrying attester-signed EIP-712 authorizations, can start an exit. The stake still goes to the withdrawer.
    • At most floor((N - 1) / 20) exits per rolling governance withdrawal delay, never below the target committee size.
    • Only on the canonical, latest rollup.

Deployment and upgrade

  • The v6 upgrade deploy script, V6UpgradePayload and runbook (#25601). The rollup is owned by governance from construction, the escape hatch is installed by the payload, and the payload refuses to run unless its predecessor is still canonical.
  • The rollup config is held in immutables (#25314), and admin paths moved into libraries to fit the EIP-170 size limit.
  • The generic deployer refuses unusable rollup configuration (#25520), and its docs now state it is the test and testnet deployer, not the mainnet path.

Packaging

  • All foundation npm packages are published under @aztec-foundation (#25328), with npm provenance from GitHub Actions.
  • bb and bb-avm ship as per-platform npm packages, byte-identical to the release tarballs, and bb-avm now builds for arm64 Linux (#25120).
  • The AVM CDB server bindings are published as @aztec-foundation/cdb (#25098).
  • barretenberg-rs is published to crates.io.
  • l1-artifacts is a standalone npm package, carrying the full l1-contracts Solidity tree and compiled ABIs.

Protocol constants

The mainnet v6 rollup (0xE37A2663Cc9c119BA41572C40fAb0bbb23a5402f, rollup version 2070860440) was deployed from this release's circuits: 

vk root               0x22fff5de6ce590153df4468f7f0b152188a803d91b3c9c648b91d93d5913f219
protocol contracts    0x0f54271c52865841a77aaa66036eed901aff22fdce9f08e123ec8b205c9854d7
genesis archive root  0x29eb2c527f8d45276430363214e6c8d709ef3f657a3670ebac3179373d41e5c4
verifier VK_HASH      0x1fd4eb1d14be45e05dc78c448eb4f29d7f63e4de95129c4a5e1058cd9837f8a6

The epoch proof verifier is pinned at l1-contracts/script/deploy/HonkVerifier.sol. Anyone can check its VK_HASH against the verified source on Etherscan.

Reference

Check out latest releases or
releases around AztecProtocol/aztec-packages v6.0.0

Don't miss a new aztec-packages release

NewReleases is sending notifications on new releases.

Get notifications