Arbitrum Halts New Stylus Activations Over Security Risks
Arbitrum’s Security Council took emergency action on October 2, 2024, to pause new Stylus contract activations on Arbitrum One and Arbitrum Nova. The measure aims to prevent potential threats to chain liveness from hand-crafted WebAssembly programs. The pause affects only the activation step, meaning developers cannot activate new contracts or renew expired ones, but existing contracts will continue running until their expiration.
The Stylus feature, launched in September 2024, allows developers to write Ethereum-compatible smart contracts in languages like Rust, compiled to WebAssembly. While it enhances customization and optimization, the Security Council identified risks associated with hand-crafted WASM programs that could disrupt chain operations. No user funds have been at risk so far, according to the Arbitrum Foundation.
The council implemented the pause by raising the Stylus activation gas requirement to an impractically high level, a change that did not require an upgrade to ArbOS, the network’s operating software. Additionally, the emergency action introduced a safeguard for BoLD’s one-step proofs on Arbitrum One, which could delay unconfirmed withdrawals if contradictory proofs are accepted. Despite the pause, the foundation remains confident in Stylus and plans to reintroduce activations while restricting hand-crafted WASM programs.
The Arbitrum Foundation will collaborate with ArbitrumDAO to determine the timeline and conditions for reopening activations. The pause follows other security incidents involving Arbitrum, including the $24 million AFX Trade bridge exploit in July and the $71 million freeze tied to the KelpDAO attacker in April.