The Arbitrum Security Council executed an emergency upgrade on Arbitrum One and Nova on October 2, 2026, at 11:30 EST, halting all new activations of Stylus contracts on both chains. The action targets vulnerabilities associated with the Stylus framework, while leaving contracts that are already active unaffected — they can continue to execute and be renewed.

The same upgrade introduced a new safeguard to Arbitrum One's dispute system: a guard on the BoLD one-step proof. If the system were ever to accept contradictory proofs, the guard could delay unconfirmed withdrawals.

What Changed

The emergency upgrade consisted of two separate measures. The first blocked new Stylus programs from being activated on Arbitrum One and Nova. The restriction applied to new entry into the framework rather than to programs already in operation.

Stylus is a framework that allows developers to write smart contracts in languages such as Rust and C++ while maintaining compatibility with the Ethereum Virtual Machine (EVM). These programs compile to WebAssembly (WASM), a compact, low-level format for executing code.

The security concern centers on hand-crafted WASM programs that have not been patched. According to the research findings, such programs could serve as denial-of-service (DoS) vectors capable of impairing the network's liveness. A liveness failure would not put funds at risk, but it could bring transaction processing across the network to a halt. The known bugs affect chain liveness rather than the safety of user funds, and earlier ArbOS patches had already addressed those issues.

The pause functions as a preemptive block, preventing unpatched WASM programs from being deployed ahead of upcoming ArbOS updates.

The BoLD Guard and Withdrawals

BoLD is Arbitrum's dispute resolution system for settling disagreements about the state of the chain. A one-step proof is the final stage of such a dispute, in which a single disputed computation step is verified directly.

The Security Council added a permissionless guard to the one-step proof mechanism on Arbitrum One. Its purpose is to protect against potential soundness issues. Should the system ever accept contradictory proofs, the guard permits settlements to be paused in a timely manner. The practical consequence is that un withdrawals could be delayed if that scenario occurs.

Notably, the guard was added to Arbitrum One specifically, whereas the Stylus activation pause covers both Arbitrum One and Nova.

Impact on Existing Builders

For teams with Stylus contracts already live, day-to-day operations are largely unchanged. Active contracts continue to function and can be renewed until expiration.

Developers planning fresh Stylus deployments, however, face an open-ended wait. Those launches now depend on a timeline that has not yet been set, and no estimated timeframe for resumption was provided. The Arbitrum Foundation said it will work with the ArbitrumDAO to determine when new Stylus activations can resume. The Foundation also characterized the emergency upgrade as part of an ongoing series of proactive measures intended to protect the network's security and integrity.

In the meantime, the concrete signals to watch are the upcoming ArbOS updates that the pause is designed to precede, along with any announcement from the Arbitrum Foundation and ArbitrumDAO fixing a date for new activations to resume. Until then, the block on activations stays in force across both chains with no stated end point.

Why It Matters

The identified issues affect liveness, not the safety of user funds, and no user funds are at risk from the currently known problems. The distinction is significant: a paused network is an inconvenience, whereas a network that loses deposits would constitute a crisis.

The BoLD guard provides a backstop for a scenario in which the proof system itself malfunctions. The trade-off is that unconfirmed withdrawals could remain in limbo if the guard is ever triggered.

The Security Council's direct involvement is also notable. Emergency powers exist for precisely these situations, in which waiting for a full governance vote could leave a known weakness exposed. By returning the restart timeline to the ArbitrumDAO, the council's role in this episode was that of a first responder rather than the permanent authority over Stylus.