Arbitrum's Security Council pauses new Stylus activations on One and Nova
Serguey Asael Shinder2 min readArbitrum's Security Council used its emergency powers on 2 October to stop new Stylus programs from being activated on Arbitrum One and Arbitrum Nova, CryptoSlate reports, citing the Council's action report and the official developer notice. The linked transactions on Ethereum, One and Nova executed around 15:30 UTC.
What Stylus is and what stops. Stylus lets developers write Arbitrum contracts as WebAssembly programs, for example in Rust, alongside ordinary Solidity contracts. Such a program is stored on chain when deployed but only becomes executable after a separate activation step. That step is what the Council has blocked. A new application version that needs fresh activation cannot go live during the pause, and neither can reactivating a program that has expired or needs reactivating after a Stylus version change. Programs that are already active stay callable until they expire, and developers can keep extending them through the permissionless keepalive mechanism. New contract instances that reuse identical, still-valid program code can use the existing activation. Solidity deployment and execution are not affected.
The Council implemented the block by raising the gas required for activation to a prohibitively high level — a configuration change, it says, that needs no upgrade to ArbOS, the network's operating software.
Why. The Council attributes the move to increasingly sophisticated AI-assisted attacks using hand-crafted WebAssembly programs built outside the standard Stylus compiler toolchain. According to its report, the known Stylus bugs mainly threaten the chain's liveness, including denial of service, and no attack that would allow theft of user funds has been found.
A second safeguard. The same action added a guard to the one-step proofs of BoLD, the dispute protocol that secures Arbitrum One's settlement to Ethereum. Anyone may present two conflicting answers to the same step of an open challenge; if the one-step proof accepts both, the guard suspends One's settlement to Ethereum. The chain would keep processing transactions, but unconfirmed messages to Ethereum, including withdrawals, would wait while the Council deploys a fix. Installing the guard does not by itself pause anything — the delay only happens if the conflict condition is met.
No date has been set for reopening activations; the notice says the Arbitrum Foundation will work with the ArbitrumDAO on when and how.
What it means
Teams building on Stylus should check whether any planned release depends on a new activation and whether their active programs need a keepalive before expiry. More broadly, the action shows the trade-off of a newer execution environment: a second virtual machine widens what can be built, and also what a determined attacker — now with AI tooling — can probe.