Arbitrum Security Council Halts New Stylus Activations Amid AI-Assisted Attack Concerns

Arbitrum’s Security Council took emergency action on October 2 by temporarily blocking new Stylus contract activations on both Arbitrum One and Nova networks. The restriction applies specifically to programs and app updates that require fresh activation, while already-active Stylus applications continue operating normally. Standard Solidity smart contract deployment and execution processes remain unaffected, according to the Council’s official action report.

The pause was prompted by increasingly sophisticated AI-assisted attacks involving hand-crafted WebAssembly programs developed outside the standard Stylus compiler toolchain. Arbitrum indicated that known Stylus vulnerabilities primarily pose risks to chain liveness, including potential denial-of-service scenarios, though no attacks enabling theft of user funds have been identified to date.

The mechanism’s technical distinction centers on activation versus deployment. While deployment stores code onchain, activation makes stored WebAssembly programs executable. New contract instances using identical program code may reuse existing activations if still valid, but applications requiring fresh activation cannot become operational during the pause period. Similarly, reactivating expired programs or those needing reactivation after a Stylus version update is suspended.

Existing programs retain functionality until expiration, and developers may continue extending active programs’ lifetimes through the permissionless keepalive renewal mechanism. However, reactivation of already-expired programs remains blocked. The Council implemented the restriction by configuring the activation gas requirement to prohibitive levels, a change requiring no upgrade to ArbOS, the network’s operating system.

Simultaneously, the emergency action established a safeguard for BoLD’s one-step proofs on Arbitrum One. If conflicting answers to the same step in an open challenge are accepted, the guard mechanism pauses settlement to Ethereum, potentially delaying unconfirmed withdrawals while processing continues normally on the network.

The image above illustrates Arbitrum’s October 2 measures: new Stylus activations are blocked on One and Nova, while active programs, keepalive functions, and standard EVM contracts continue operating. A separate mechanism monitors for conflicting proofs that could trigger settlement suspension.

For developers awaiting reactivation permissions, no timeline has been established for resuming activations. The Council and Arbitrum Foundation will coordinate with ArbitrumDAO on the restoration process and communication strategy moving forward.

Source link