Key points

  • The Arbitrum Security Council temporarily stopped new Stylus activations on Arbitrum One and Nova.
  • Already-active Stylus programs remain callable, keepalive renewals continue and Solidity contracts are unaffected.
  • A separate BoLD safeguard can pause settlement to Ethereum if conflicting proofs are accepted.

Emergency action changes two safeguards

Arbitrum’s Security Council has temporarily paused the activation of new Stylus programs on Arbitrum One and Arbitrum Nova as part of an emergency action completed on October 2. The same action installed a separate safeguard for Arbitrum One’s BoLD dispute system. The council said no attack had occurred and no user funds were affected. Its report described the changes as precautionary responses to potential chain-liveness risks rather than a reaction to stolen assets or a confirmed compromise.

The pause targets activation, not normal use

The restriction applies to the step that makes a Stylus program callable. Developers cannot activate a new program, reactivate an expired one or deploy an application update that requires a fresh activation while the pause remains in force. Programs that were already active continue to run until their activation expires, and users can still call them without permission. Arbitrum’s developer notice says the permissionless keepalive mechanism remains available for renewing an active program before it expires.

Related reporting: Blast to Wind Down Ethereum Layer 2 by October 26

Solidity contracts remain unaffected

The measure does not stop Solidity or other Ethereum Virtual Machine contract deployment and execution. Arbitrum also said the ArbOS 61 upgrade renewed active Stylus programs on Arbitrum One, so none of those programs is due to expire before August 20, 2027. That gives existing applications a substantial operating window, although projects preparing new Stylus releases must wait for activations to reopen.

AI-assisted testing raised the concern

According to the Security Council, increasingly capable AI-assisted tools have made it easier to create hand-crafted WebAssembly programs outside the standard Stylus compiler toolchain. Some such programs can be designed to trigger unexpected behaviour or degrade network performance. Arbitrum said known Stylus bugs primarily threaten liveness, including through denial-of-service conditions, and that it had not discovered an attack that permits theft of user funds.

A configuration change enforces the pause

The council implemented the Stylus restriction by setting the network’s activation gas requirement to the maximum 64-bit value on One and Nova, making new activations prohibitively expensive. It described this as a configuration change rather than an ArbOS software upgrade. The official report links the onchain transactions used to apply the settings and says the Foundation will work with ArbitrumDAO on the timetable and conditions for restoring activations.

BoLD guard addresses a separate proof risk

The emergency payload also introduced a permissionless guard for Arbitrum One’s one-step proof process. If two conflicting answers to the same step of an open challenge are both accepted where only one should pass, anyone can use the guard to put settlement from One to Ethereum on hold. Arbitrum One would continue processing transactions, but unconfirmed messages to Ethereum, including withdrawals, would wait while the Security Council deploys a fix and resumes settlement.

Reopening has no announced date

Installing the guard does not itself pause withdrawals, and the Stylus action does not deactivate existing applications. Those distinctions limit the immediate effect on users while preserving a response mechanism for two different technical risks. Arbitrum has not announced when new Stylus activations will resume. The Foundation said it will consult ArbitrumDAO on how and when to reopen the feature while retaining useful applications and limiting risky hand-crafted programs. Until then, developers can continue using active programs and Solidity contracts, but new or expired Stylus code cannot complete the activation step on One or Nova.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.