Arbitrum Halts New Stylus Contract Activations in Emergency Security Move

Arbitrum's Security Council has temporarily suspended new Stylus contract activations on Arbitrum One and Arbitrum Nova, citing security concerns, according to a notice from the Arbitrum Foundation. The emergency measure took effect on October 2 and is aimed at mitigating risks from handcrafted WebAssembly (WASM) programs that could jeopardize chain liveness. The suspension is narrowly scoped to the activation step that makes a Stylus contract callable. During the pause, developers cannot activate new Stylus contracts or reactivate expired ones. Contracts that are already active will continue operating until their activations expire. Activation is required for a deployed Stylus contract to become executable, so the freeze effectively prevents new Stylus applications and upgrades from going live. Activations last 365 days by default, and keepalive renewals remain permissionless. Standard Solidity and EVM contract deployment and execution are unaffected. Stylus, launched in September 2024, enables developers to build Ethereum-compatible smart contracts in languages such as Rust that compile to WASM. It is intended to help chain owners customize networks and allow developers to optimize critical contracts. The Security Council's concern focuses on handcrafted WASM programs that could be used for denial-of-service attacks affecting liveness. The foundation said reviewed Stylus contracts have only raised liveness-related issues so far, and no user funds have been at risk. To implement the pause, the council raised the Stylus activation gas requirement to a prohibitively high level. The foundation said the change is configuration-based and does not require an ArbOS upgrade. In the same emergency action, Arbitrum introduced an additional safeguard for BoLD's one-step proofs on Arbitrum One. The measure is designed to prevent a scenario in which contradictory proofs are accepted, which could delay unconfirmed withdrawals. Arbitrum One would continue processing transactions normally even if such a withdrawal-related suspension were triggered. The ArbOS 61 upgrade already renewed all active Stylus contracts on Arbitrum One, meaning no currently active Stylus contract on Arbitrum One expires before August 20, 2027. The Arbitrum Foundation said it will work with the ArbitrumDAO to decide when and how to reopen activations, and the Security Council has not provided a timeline. The pause comes amid a series of security-related episodes for Arbitrum, including the $24 million AFX Trade bridge exploit in July and the $71 million freeze tied to the KelpDAO attacker in April.