Arbitrum Security Council pauses Stylus contract activations

The October 2nd Emergency Action

Arbitrum’s Security Council paused new Stylus contract activations on Arbitrum One and Nova on October 2, 2026. This action followed reports that hand-crafted WebAssembly programs, potentially assisted by AI, could degrade network performance. The council’s report links the move to AI-assisted tooling and hand-crafted WebAssembly programs designed to degrade chain performance. These bugs primarily threaten the network’s ability to process transactions. The Security Council implemented the restriction by raising the activation gas requirement to a prohibitively expensive level, a configuration change that did not require any upgrade to the ArbOS operating software or any change to the existing contract deployment process. This freeze blocks new code and application upgrades that require activation. It also blocks the reactivation of expired contracts.

The decision does not affect Solidity or EVM contract deployment and execution. Already-active contracts continue to function. You should note that developers can still extend an active program’s lifetime through the keepalive mechanism before it expires. New contract instances using identical program code can reuse an existing activation, provided it is still valid. No attack has occurred, and no user funds are affected. The freeze targets the activation step, which separates code deployment from execution.

The same emergency action installed a guard for the one-step proof used by BoLD, the dispute-resolution protocol for Arbitrum. This guard, named OspSoundnessGuard, allows anyone to submit two conflicting answers for the same step in an open challenge. If the proof contract accepts both, the guard uses a PauseExecutor contract to halt Arbitrum One’s settlement to Ethereum. The PauseExecutor contract has pause-only authority. If triggered, Arbitrum One continues processing transactions normally, but unconfirmed withdrawals to Ethereum delay.

WASM and Developer Programmability

Stylus is an upgrade to Arbitrum Nitro. It allows developers to write smart contracts in Rust, C, and C++. These programs compile to WebAssembly. Stylus code requires a separate activation step to become executable after deployment. This differs from conventional Ethereum Virtual Machine contracts. The WASM virtual machine executes WASM instead of EVM bytecode. This allows developers to use packages and libraries from the Rust ecosystem. Stylus provides direct interoperability with the EVM.

Stylus reduces memory usage costs by up to 100x. This enables the use of large amounts of RAM for complex applications. In May, Offchain Labs released Stylus 0.9. This update included a new inheritance model and constructor support. The team is now working on version 0.10. This upcoming release will include multi-contract workflows and better type support. The capacity to use multiple languages expands the scope of applications on Arbitrum.

How can developers manage the transition from Solidity to WASM?

The Stylus Sprint Program

The Stylus Sprint program supports builders with ARB grants. The program has a 5M ARB budget. During the application process, 147 submissions requested approximately 32M ARB. This demand far exceeds the initial 5M ARB budget. The committee selected 17 projects for funding. The Open Application Track included 89 submissions. The RFP Track included 58 submissions across nine categories. Selected teams will work with the evaluation committee for the next 12 months.

The committee includes Michael Lewellen, Gustavo Gonzalez, SEEDGov, JoJo, and Entropy Advisors. Selected projects cover many areas. Thirdweb integrates Stylus into its full-stack development platform. RedStone develops Rust versions of pull and push oracles to reduce costs and increase security. Wakeup Labs builds a tool to compile AssemblyScript into WebAssembly. CoBuilders creates a graphical interface for the Stylus Cache Manager. Fairblock builds sealed-bid infrastructure for DeFi and RWA applications. Passport XYZ expands its ID verification system to consolidate ID proofs across multiple wallets.

Market conditions have changed the program’s trajectory. Most teams designed their project scope with the price of ARB between $0.70 and $0.80. The current price of ARB is lower than what most teams anticipated. This has forced some teams to operate in the red. The Passport and Ember projects withdrew from the sprint. Trail of Bits also withdrew its Medusa application to focus on its Solang application. The committee looks for projects that scale Stylus usage. They prioritize projects that contribute to infrastructure and fill a unique niche.

Tooling and Security Partnerships

OpenZeppelin and the Arbitrum Foundation partnered to bring OpenZeppelin Contracts to Stylus. This library includes token standards like ERC20, ERC721, and ERC1155. It also provides access control, safe ERC20 utilities, and upgradeable proxies. The library includes Transparent and UUPS proxies. It also includes components like ERC165 Utils and ERC2771Forwarder. OpenZeppelin will also extend Defender capabilities to support Arbitrum Stylus. This extension helps with smart contract automation and security operations. OpenZeppelin’s audit team provides security services to builders in the ecosystem.

The Enclave project failed its original goal because the data and computation sizes for FHE proved too large for the Stylus VM. The team concluded that the originally envisioned stylus-based compute provider was not viable. Enclave now works on a universal ZKVM verifier. This verifier can leverage various ZKVMs as a compute provider.

Developers use the Stylus SDK to build contracts. The SDK helps with onboarding and deployment. The Stylus Saturdays Odyssey initiative provides documentation to onboard new developers. Alex built Stylusup, a one-liner creation and setup script. He also built OrderbookKit for one-click deployment of an orderbook to any Arbitrum chain.