The cost of hand-crafted WASM and the Stylus activation pause

The activation barrier and AI-assisted threats

The Security Council changed the configuration of the Arbitrum network on October 2, 2026. They used the ArbOwner.setWasmActivationGas command to set the activation gas requirement to 2^64 – 1 for both Arbitrum One and Nova. This change makes the activation of new Stylus contracts prohibitively expensive. The council took this action because AI-assisted tooling has increased the frequency of sophisticated attacks on hand-crafted WASM programs. These programs bypass the standard Stylus compiler toolchain to cause unexpected behaviors that degrade the performance of the chain for all users. No attacks permitting the theft of user funds have been discovered via this method so far. This action follows the implementation of a guard for the one-step proof of BoLD, which uses the OspSoundnessGuard and PauseExecutor to allow anyone to pause settlement on Ethereum if two conflicting answers pass the same level. This guard provides a way to halt the class of publicly verifiable and detectable attacks that exploit bugs in the one-step proof.

Friction in the Rust development workflow

The development lifecycle in Stylus remains fragmented. I see developers struggling because the workflow splits between native Rust tooling and cargo-stylus. Developers must use the native cargo CLI for compilation, but they use cargo-stylus for checking the binary and deploying. This separation introduces friction. The development stack also targets programs with a single entrypoint, which creates friction for developers with extensive EVM experience. In many cases, a user must explicitly comment or uncomment code to make only a single entrypoint available. The lack of constructor support in the Stylus environment forces developers into specific mistakes. An ERC20 contract that normally accepts symbol, name, and decimals as constructor arguments must instead use generics in Stylus contracts. This usage increases the size of the code and the complexity of the logic compared to Solidity. Developers also face confusion regarding project setup, as they must configure projects for both a binary and a library. Binaries are necessary for exploring the ABI of the program, while a library is necessary for the deployment process. The Stylus VM supports the "wasm32-unknown-unknown" target triple. If you are currently managing a contract, you should know that existing contracts continue to execute until they expire. The ArbOS 61 upgrade renewed all active contracts on Arbitrum One, meaning no currently active contract expires before August 20, 2027.

Technical vulnerabilities and SDK configuration

Technical errors in the Stylus SDK lead to significant vulnerabilities. An audit of the stylus-sdk-rs repository at commit 62bd831 identified 36 total issues. The audit found two critical severity issues and two high severity issues.

Developers make mistakes when selecting and configuring external crates. Even compact and WASM-optimized crates, such as ed25519-compact, require explicit configuration and stripping to meet the size requirements of Stylus programs. Relying on these crates without proper adjustments leads to deployment failures. The SDK uses macros like #[entrypoint] to handle incoming calls and #[external] to manage ABI encoding and decoding. It also uses #[solidity_storage] to ensure storage layouts align with Solidity. While the #[message] macro handles type conversion and function selector calculation, the #[derive_solidity_error] macro converts Rust enums into Solidity-compatible error messages. The #[derive_erase] macro generates an "erase()" method to clear complex storage structures. The abi module provides functionality for encoding and decoding data according to the Ethereum Application Binary Interface, and the call module manages interactions with external contracts. The deploy module facilitates the deployment of contracts on the Arbitrum network through both standard and raw functions. The hostio module provides functions for managing contract state and handling I/O operations via a foreign-function interface. The block module provides access to Ethereum block information, including the block number and timestamp. The msg module handles message-passing, providing details such as the sender and value. The tx module provides transaction-related functionality, including access to gas price and origin. The storage module provides a framework for managing smart contract storage, featuring abstractions for data structures like arrays and maps. Mistakes in using these macros or the underlying StorageType trait can break compatibility with the EVM storage model.

The deployment deadlock

The current pause on new activations creates a bottleneck for developers. The Security Council decision to raise activation gas means that new contract activations are effectively disabled. This pause also blocks the activation of new versions of existing applications. Developers cannot reactivate a contract that has expired or update a contract after a Stylus version change. Will the developers be able to resume deployment before the next major network upgrade? The restriction on contract activation remains a significant hurdle for those attempting to launch new projects using the WASM VM.