Arbitrum Halts New Stylus Contract Deployments Amid Security Concerns
Arbitrum has temporarily suspended a key developer feature, pausing all new activations of its Stylus contracts across Arbitrum One and Nova. The decision, enacted by the Arbitrum Security Council on October 2, 2026, at 11:30 EST, addresses vulnerabilities within the Stylus framework. Existing Stylus contracts remain unaffected and continue to function.
Stylus Framework Under Scrutiny
Stylus is designed to enable developers to write smart contracts in languages such as Rust and C++, while maintaining compatibility with the Ethereum Virtual Machine (EVM). These programs are compiled into WebAssembly (WASM), a compact, low-level code format. The current concern centers on hand-crafted WASM programs that have not been updated.
Research indicates that these unpatched programs could be exploited as denial-of-service (DoS) vectors, potentially impacting the network’s liveness. While such issues do not pose a risk to user funds, they could lead to network slowdowns or complete halts. Previous patches to Arbitrum’s operating system (ArbOS) had already addressed some of these liveness concerns.
The pause is intended as a preemptive measure, preventing unpatched WASM programs from being deployed before upcoming ArbOS updates.
Enhanced Dispute Resolution System
In addition to pausing Stylus activations, the emergency upgrade introduced a new safety mechanism to Arbitrum One’s dispute resolution system, known as BoLD. This mechanism, a “guard” on the BoLD one-step proof, is designed to protect against potential soundness issues. If the system were to accept contradictory proofs, this guard could delay unconfirmed withdrawals.
BoLD is Arbitrum’s system for resolving disagreements about the state of the blockchain. A one-step proof represents the final stage of such a dispute, where a single contested computational step is directly verified. The newly added permissionless guard on Arbitrum One’s one-step proof mechanism aims to prevent the system from accepting conflicting proofs, allowing settlements to be paused in a timely manner if such a scenario arises. The practical implication is that unconfirmed withdrawals could face delays if this safeguard is triggered.
It is important to note that the BoLD guard was specifically added to Arbitrum One, while the Stylus activation pause affects both Arbitrum One and Nova.
Impact on Developers and Future Outlook
For development teams with existing Stylus contracts already deployed, daily operations are largely unchanged. These active contracts will continue to function and can be renewed until their expiration. However, developers planning new Stylus deployments will have to wait for an unspecified timeline.
The Arbitrum Foundation stated that it will collaborate with the ArbitrumDAO to determine when new Stylus activations can resume. The Foundation characterized the emergency upgrade as part of a broader series of proactive measures to safeguard the network’s security and integrity.
The identified issues primarily affect network liveness rather than the security of user funds, and no user funds are currently at risk. The distinction is crucial: a network outage is an inconvenience, whereas a loss of user deposits constitutes a crisis.
The implementation of the BoLD guard serves as a backstop against potential misbehavior within the proof system itself. The trade-off for this added security is the possibility of unconfirmed withdrawals being held in limbo if the guard is activated.
The decision to utilize the Security Council for this emergency upgrade highlights the existence of special powers for critical situations where a full governance vote might leave a known vulnerability exposed. By returning the decision on when to re-enable Stylus activations to the ArbitrumDAO, the council appears to be acting as an initial responder rather than a permanent arbiter of Stylus’s future.
