Arbitrum’s Security Council has temporarily blocked new Stylus contract activations on Arbitrum One and Arbitrum Nova. The October 2 emergency action addresses denial-of-service risks linked to hand-crafted WebAssembly programs. Arbitrum’s notice says the reviewed Stylus findings threatened chain liveness, not user funds.
The restriction applies to activation, the step that makes deployed Stylus code callable. Developers cannot activate a new contract or reactivate one that has expired while the pause remains in force. Contracts activated before the change can continue running until they expire, and users can still call them. Developers can also renew active contracts through the permissionless keepalive mechanism.
What remains available
Ordinary Solidity and Ethereum Virtual Machine contract deployment and execution are unaffected. The action therefore does not stop Arbitrum One or Nova, disable every Stylus application or freeze users’ assets. It narrows one route for introducing executable Stylus code while the Foundation and ArbitrumDAO consider how to reopen activations.
Stylus lets developers write contracts in languages such as Rust that compile to WebAssembly. That flexibility also creates a security boundary around code built outside the standard compiler toolchain. In its emergency-action report, the Security Council said specially constructed WASM programs could degrade chain performance. It raised the activation gas requirement to a prohibitively high value, effectively disabling new activations without an ArbOS upgrade.
An activation normally lasts 365 days. Arbitrum’s documentation says an active contract can be renewed once it is old enough for the keepalive process. The Security Council report adds that ArbOS 61 renewed active contracts on Arbitrum One, so none of those contracts is due to expire before August 20, 2027. An expired contract still cannot be reactivated during the pause.
The emergency action also added a settlement guard
The same Security Council payload installed a separate safeguard for Arbitrum One’s one-step proof system. If two conflicting answers are accepted for the same challenge step, anyone can use the guard to pause settlement to Ethereum. Arbitrum One would continue processing transactions, but unconfirmed messages to Ethereum, including withdrawals, would wait while the issue was addressed.
That settlement guard and the Stylus pause respond to different risks. The first creates a way to halt final settlement when a publicly detectable proof conflict appears. The second prevents new Stylus activations. Neither measure is evidence that funds were stolen, and Arbitrum has not announced a date for restoring activations.
The Foundation says it will work with the ArbitrumDAO on the timing and conditions for reopening. Its stated goal is to preserve Stylus uses while restricting hand-crafted WASM programs that bypass the standard toolchain. Until that process is settled, builders can maintain and call active contracts but cannot make new or expired Stylus deployments executable on the two affected networks.
Adapted from Arbitrum Pauses New Stylus Activations in Security Action.