The Arbitrum Security Council executed an emergency upgrade on Arbitrum One and Arbitrum Nova at 11:30 EST on October 2, 2026, halting all new activations of Stylus smart contracts across both chains. Existing Stylus contracts continue to execute and renew through their original expiration terms, the council said.

What triggered the activation pause?

The freeze targets vulnerabilities in the Stylus framework, which compiles contracts written in Rust, C++ and other languages into WebAssembly (WASM) for execution alongside the Ethereum Virtual Machine. According to research findings cited in the upgrade notice, hand-crafted WASM programs that predate the fix could serve as denial-of-service vectors capable of impairing network liveness. Earlier ArbOS patches had already mitigated the most acute vectors, the Arbitrum Foundation said. The Foundation framed the activation halt as a preemptive block on unpatched WASM deployments ahead of further ArbOS updates.

The Arbitrum Foundation stated it would coordinate with the ArbitrumDAO to set a resumption timeline, characterizing the council's role as first-responder rather than permanent authority. No user funds are exposed under the currently identified issues, the Foundation added.

What does the BoLD guard actually do?

The upgrade carried a second change layered onto Arbitrum One only: a permissionless guard on the one-step proof within BoLD, Arbitrum's dispute resolution protocol. The one-step proof verifies a single disputed state transition directly on-chain; BoLD governs how those disputes are settled. If the system ever accepts two contradictory proofs, the new guard enables a timely pause on settlements. The operational consequence is narrower than the Stylus freeze but more severe in tail scenarios: unconfirmed withdrawals could be delayed indefinitely while the guard remains active.

The guard was added only to Arbitrum One, while the Stylus activation pause applies to both Arbitrum One and Arbitrum Nova.

Which builders are affected and which are not?

Teams with deployed Stylus contracts face no immediate change. Active contracts continue to execute and can be renewed until natural expiration. The disruption falls on developers queuing fresh Stylus launches, which now sit behind an unset governance timeline.

The Arbitrum Foundation said it will work with the ArbitrumDAO to determine when new Stylus activations can resume.

Why does this matter operationally?

The distinction between liveness and safety carries the story. A network that halts transactions is an inconvenience; a network that compromises deposits is a failure of solvency. The council acted to keep the chain running while preventing the deployment of code paths that could degrade throughput. The BoLD guard introduces a second backstop, addressing a theoretical failure mode in which the dispute layer itself accepts inconsistent state transitions. The cost of that backstop surfaces only under that pathological scenario, where withdrawals stall.

Use of the Security Council's emergency powers also signals how Arbitrum intends to handle time-sensitive threats. A full DAO vote would leave a known weakness exposed during the proposal window; the council's intervention compresses that gap. Handing the restart decision back to governance preserves decentralization for routine operations while preserving speed for incidents.

What's the forward calendar?

The Arbitrum Foundation has not published a date for resuming Stylus activations. The next concrete checkpoint is an ArbitrumDAO coordination step on the restart timeline, followed by additional ArbOS updates that will determine which WASM paths are reopened to developers. Until that vote concludes, every fresh Stylus deployment on either chain waits.