Arbitrum’s Security Council temporarily paused new Stylus contract activations on Arbitrum One and Arbitrum Nova in an emergency action on October 2, a security measure against hand-crafted WebAssembly programs that could threaten chain liveness, according to a notice published by the Arbitrum Foundation.
What the pause covers
The pause applies only to the activation step that makes a Stylus contract callable. Developers cannot activate new Stylus contracts or reactivate expired ones while it is in force, but already-active contracts keep running until they expire. Activation is the step that makes a deployed Stylus contract executable, so the freeze blocks new Stylus applications and upgrades from going live. An activation lasts 365 days by default, and keepalive renewals remain permissionless. Ordinary Solidity and EVM contract deployment and execution are unaffected.
Why the Security Council acted
Stylus, which launched in September 2024, lets developers write Ethereum-compatible smart contracts in languages such as Rust, compiled to WebAssembly. It is designed to let chain owners customize their networks and developers optimize key contracts. The concern centers on hand-crafted WASM programs that pose a denial-of-service risk to chain liveness. To date, all Stylus findings from reviewed contracts have only threatened liveness, and no user funds have been at risk, according to the notice.
The council implemented the pause by raising the Stylus activation gas requirement to a prohibitively high level, a configuration change that needs no upgrade to ArbOS, the network’s operating software. The foundation said it remains confident in Stylus and will reopen activations while restricting hand-crafted WASM programs.
A new guard on withdrawals
The same emergency action added a safeguard for BoLD’s one-step proofs on Arbitrum One, which could delay unconfirmed withdrawals if contradictory proofs are ever accepted. Arbitrum One would continue processing transactions normally during any such suspension. The ArbOS 61 upgrade already renewed all active Stylus contracts on Arbitrum One, so none currently active there expires before August 20, 2027.
What comes next
The Arbitrum Foundation said it will work with the ArbitrumDAO to determine when and how activations reopen, and the council has not yet set a timeline. The pause adds to a run of security events around Arbitrum, including the $24 million AFX Trade bridge exploit in July and the $71 million freeze tied to the KelpDAO attacker in April.
