Arbitrum Halts New Stylus Activations Over DoS Risk

Arbitrum’s Security Council temporarily paused new Stylus contract activations on Arbitrum One and Arbitrum Nova on Oct. 2 after identifying a denial-of-service risk from hand-crafted WebAssembly programs that could affect the networks’ ability to process transactions.

The pause applies to the activation stage that makes a deployed Stylus contract callable. Developers cannot activate new Stylus contracts or reactivate contracts whose 365-day activation periods have expired. Already-active contracts will continue running until their current periods end, and permissionless keepalive renewals remain available.

The council imposed the pause by raising the gas requirement for Stylus activation to a prohibitively high level. The configuration change did not require an upgrade to ArbOS, Arbitrum’s network software.

Stylus lets developers write Ethereum-compatible smart contracts in languages such as Rust and compile them into WebAssembly. The technology launched in September 2024. The Foundation’s notice identifies hand-crafted WebAssembly programs as a potential threat to chain liveness. Reviewed Stylus-related findings have not presented a risk to user funds, according to the notice.

The pause does not affect the deployment or execution of ordinary Solidity or Ethereum Virtual Machine contracts. The restriction applies to the process that makes a Stylus contract callable, rather than to Stylus contracts already operating on the networks.

The emergency action added a safeguard for BoLD one-step proofs on Arbitrum One. If contradictory proofs are accepted, the safeguard could delay unconfirmed withdrawals. Transactions on Arbitrum One would continue processing during such a suspension.

An ArbOS 61 upgrade renewed all active Stylus contracts on Arbitrum One. None of those contracts is scheduled to expire before Aug. 20, 2027.

The Arbitrum Foundation plans to reopen activations while restricting hand-crafted WebAssembly programs. It will work with the ArbitrumDAO to determine when and how activations can resume, but no timeline has been set.

The pause follows a $24 million bridge exploit involving AFX Trade in July and a separate incident in April that resulted in a $71 million freeze tied to an attacker linked to KelpDAO.