The Arbitrum Security Council implemented an emergency action on October 2 to temporarily block new Stylus contract activations across Arbitrum One and Arbitrum Nova following identified risks from AI-assisted attacks.
Emergency Safeguards Implemented via Gas Adjustment
On-chain records show the execution of the emergency action between 15:30 and 15:31 UTC on October 2. The security intervention addresses increasingly complex AI-assisted attacks utilizing custom WebAssembly (Wasm) code generated outside the standard Stylus compiler toolchain. According to official reports, the identified bugs pose risks to chain liveness and present potential denial-of-service vectors, though no vulnerabilities permitting the theft of user funds have been detected.
To execute the pause without requiring an upgrade to ArbOS (the network's operating software), the Arbitrum Security Council raised the activation gas fee requirement to a prohibitively high level. This configuration change selectively blocks fresh contract activations while allowing existing, active Stylus applications and standard Solidity smart contracts to continue operating normally.
Impact on Developers and Settlement Safeguards
Developers can continue deploying code on-chain, but new programs cannot be activated to become executable during the suspension. Key operational parameters during the pause include:
- Existing Active Applications: Remain fully callable and operational until their scheduled expiration.
- Keepalive Mechanism: Developers can extend active contract lifespans using standard renewal functions.
- Blocked Operations: Reactivations of expired programs, application updates needing fresh activation, and new Stylus codebase activations are paused.
- Solidity Contracts: Standard Solidity deployment and execution remain entirely unaffected.
Alongside the Stylus restrictions, the emergency measure deployed a defense guard for BoLD's one-step proofs on Arbitrum One. If two conflicting state proofs are submitted for the same step in a dispute challenge and both are accepted, settlement messages from Arbitrum One to Ethereum—including pending withdrawals—will be automatically paused while the council deploys a resolution.
Why It Matters
This incident underscores the rising complexity of smart contract security in layer-2 ecosystems as developer tooling expands beyond traditional Ethereum Virtual Machine (EVM) environments like Solidity to multi-language runtimes like WebAssembly. As automated AI tools lower the barrier for generating highly optimized edge-case code outside standard compilers, network security frameworks must proactively mitigate novel denial-of-service vectors. As seen in other structural challenges across Ethereum L2 network deployments, maintaining uninterrupted chain liveness while integrating complex execution environments remains a critical balance for layer-2 scaling solutions.
The Arbitrum Foundation and ArbitrumDAO have not set a specific date for restoring Stylus contract activations, stating that reopening details will be coordinated in upcoming governance updates.
