Arbitrum pauses new Stylus activations over AI-assisted attack risks

Arbitrum's Security Council temporarily blocked new Stylus contract activations on Arbitrum One and Nova in an October 2 emergency action. The restriction affects programs and application updates requiring fresh activation. Already-active Stylus applications can keep running, according to the Council's action report. Ordinary Solidity contract deployment and execution remain unaffected, according to the action report. Linked Ethereum, Arbitrum One and Nova transaction records show successful execution on October 2, around 15:30 to 15:31 UTC.

Arbitrum attributed the precaution to increasingly sophisticated AI-assisted attacks involving hand-crafted WebAssembly programs outside the standard Stylus compiler toolchain. Arbitrum said known Stylus bugs primarily threaten chain liveness, including denial-of-service risks. Arbitrum said no attack permitting theft of user funds had been discovered.

Stylus contracts run WebAssembly programs that require activation to become executable. Arbitrum's documentation distinguishes activation from deployment, which stores code onchain. New contract instances using identical program code can reuse an existing activation, provided the activation remains valid. A new application version requiring fresh activation cannot become executable during the pause. The Council said the restriction also blocks reactivation of expired programs and programs requiring reactivation after a Stylus version change. The restriction targets activation rather than deployment of every new contract instance.

Existing programs remain callable until expiration. The official pause notice says developers can extend an active program's lifetime through the permissionless keepalive renewal mechanism before expiration. However, reactivation of an already-expired program is blocked. The Council said it imposed the restriction by raising the activation gas requirement to a prohibitively expensive level. The Council described the restriction as a configuration change requiring no upgrade to ArbOS, the network's operating software.

The same emergency action installed a separate safeguard for BoLD's one-step proofs on Arbitrum One. The Council said anyone can present two conflicting answers to the same step of an open challenge. The Council said the safeguard suspends One's settlement to Ethereum if the one-step proof accepts both answers. Arbitrum said One would continue processing normally during that suspension. However, Arbitrum said unconfirmed messages from One to Ethereum, including withdrawals, would wait while the Council deploys a fix and resumes settlement. Installing the safeguard does not itself pause withdrawals; a delay depends on the conflict condition being met.

The October 2 action report and developer notice give no date for restoring activations. The notices say the Arbitrum Foundation will work with ArbitrumDAO on the timeline and manner of restoring activations.