1 hour ago
12
Arbitrum just hit the brakes on one of its signature developer features. The Arbitrum Security Council carried out an emergency upgrade on Arbitrum One and Nova on October 2, 2026, at 11:30 EST, pausing all new activations of Stylus contracts on both chains.
The move targets vulnerabilities tied to the Stylus framework. Existing Stylus contracts are untouched: they can still execute and be renewed. This is a locked front door, not an evacuation.
The upgrade also added a new safety mechanism to Arbitrum One’s dispute system, called a guard on the BoLD one-step proof. If contradictory proofs are ever accepted, that guard could delay unconfirmed withdrawals.
What actually changed
The emergency upgrade did two separate things. First, it stopped new Stylus programs from being activated on Arbitrum One and Nova.
Stylus is the framework that lets developers write smart contracts in languages like Rust and C++, while keeping compatibility with the Ethereum Virtual Machine (EVM).
Those programs compile to WebAssembly, or WASM, a compact low-level format for running code. The concern here centers on hand-crafted WASM programs that have not been patched.
According to the research findings, such programs could be used as denial-of-service (DoS) vectors that impair the network’s liveness. A liveness bug won’t steal your money, but it could make the network grind to a halt.
The known bugs affect chain liveness, not the safety of user funds. Earlier ArbOS patches had already addressed those issues.
The pause works as a preemptive block. It stops unpatched WASM programs from being deployed ahead of upcoming ArbOS updates.
The BoLD guard and withdrawals
BoLD is Arbitrum’s dispute resolution system for settling disagreements about the state of the chain. A one-step proof is the final step in such a dispute, where a single disputed computation step is checked directly.
The Security Council added a permissionless guard to this one-step proof mechanism on Arbitrum One. Its job is to protect against potential soundness issues. If the system ever ends up accepting contradictory proofs, the guard allows settlements to be paused in a timely way.
The practical consequence: unconfirmed withdrawals could be delayed if that scenario plays out.
Notably, the guard was added to Arbitrum One specifically. The Stylus activation pause applies to both Arbitrum One and Nova.
What existing builders should know
For teams that already have Stylus contracts live, the day-to-day picture is largely unchanged. Active contracts continue to work and can be renewed until expiration.
The pain lands on developers who were planning fresh Stylus deployments. Those launches now wait on a timeline that hasn’t been set yet.
The Arbitrum Foundation said it will work with the ArbitrumDAO to determine when new Stylus activations can resume. The Foundation also framed the emergency upgrade as part of an ongoing series of proactive measures meant to protect the network’s security and integrity.
Why this matters
The identified issues affect liveness, not user fund safety, and no user funds are at risk from the currently known problems. That distinction matters: a network that pauses is inconvenient, while a network that loses deposits is a crisis.
The BoLD guard adds a backstop for a scenario where the proof system itself misbehaves. The cost of that backstop is that withdrawals that haven’t been confirmed could sit in limbo if it’s ever triggered.
The use of the Security Council itself is another signal. Emergency powers exist for moments like this, where waiting on a full governance vote could leave a known weakness open. The decision to hand the restart timeline back to the ArbitrumDAO suggests the council is acting as a first responder, not as the permanent authority on Stylus.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
English (US) ·