Arbitrum Security Council pauses new Stylus activations, citing AI-assisted attacks
In brief
- Arbitrum's Security Council blocked new Stylus activations on Arbitrum One and Nova on October 2.
- Already-active Stylus apps keep running, and Solidity contracts are unaffected, per the Council.
- Arbitrum cited AI-assisted attacks and said it found no attack that permits theft of user funds.
- A separate BoLD guard holds settlement to Ethereum only if a proof conflict occurs.
- No reopening date was given; the Foundation will set a timeline with ArbitrumDAO.
What the pause covers
Stylus contracts run WebAssembly programs, and those programs need activation before they're executable. Arbitrum's documentation treats activation as a separate step from deployment, which stores code onchain. The pause targets that step and nothing else.
New contract instances that use identical program code can reuse an existing activation if it's still valid. A new app version that needs fresh activation can't become executable during the pause. The Council said reactivating an expired program, or one that needs reactivation after a Stylus version change, is blocked too.
Existing programs stay callable until they expire. According to the official pause notice, developers can keep extending an active program's lifetime before expiry through the permissionless keepalive renewal mechanism.
So how was it done? The Council said it raised the activation gas requirement to a prohibitively expensive level. It described this as a configuration change that doesn't require an upgrade to ArbOS (the network's operating software). The linked Ethereum, Arbitrum One and Nova transaction records showed successful execution on October 2, at around 15:30 to 15:31 UTC.
Why Arbitrum moved
Arbitrum said the precaution responds to AI-assisted attacks that use hand-crafted WebAssembly programs built outside the standard Stylus compiler toolchain. It said known Stylus bugs mainly threaten chain liveness, including denial-of-service risks, and that no attack permitting theft of user funds had been discovered.
Neither document gave a reopening date.
The October 2 report and developer notice said the Foundation will work with ArbitrumDAO on when and how activations are restored.
A separate guard on BoLD proofs
The same emergency action installed a safeguard for BoLD's one-step proofs on Arbitrum One. Under it, anyone can present two conflicting answers to the same step of an open challenge. According to the Council, if the one-step proof accepts both answers, the guard puts Arbitrum One's settlement to Ethereum on hold.
Arbitrum said Arbitrum One would keep processing normally during that kind of suspension. Unconfirmed messages from Arbitrum One to Ethereum (withdrawals included) would have to wait while the Council deploys a fix and resumes settlement. Installing the guard doesn't pause withdrawals by itself. A delay only happens if the conflict condition is actually met.
Frequently asked questions
Are Arbitrum withdrawals to Ethereum paused right now?
No. Installing the BoLD guard doesn't pause withdrawals by itself. Unconfirmed messages from Arbitrum One to Ethereum, including withdrawals, would only have to wait if the guard's conflict condition is met and settlement is put on hold while the Council deploys a fix.
Do existing Stylus apps on Arbitrum still work during the pause?
Yes. Already-active Stylus applications can keep running, and existing programs stay callable until they expire. Developers can extend an active program's lifetime before expiry through the permissionless keepalive renewal mechanism. Ordinary Solidity contracts aren't affected.
What is Stylus activation and how is it different from deployment?
Stylus contracts run WebAssembly programs, which need activation before they're executable. Arbitrum's documentation treats activation as separate from deployment, which stores code onchain. New instances that use identical code can reuse a valid existing activation.
When will Arbitrum reopen new Stylus activations?
No date has been given. The October 2 report and developer notice said the Foundation will work with ArbitrumDAO on the timeline and manner of restoring activations.
