Arbitrum Security Committee urgently suspended the activation of the new contract Stylus and added BoLD protection

On October 2, at 11:30 AM Eastern Time, the Arbitrum Security Committee executed an emergency upgrade on Arbitrum One and Nova, suspending the activation of all new Stylus contracts on both chains, while adding a protective mechanism against BoLD single-step proofs in the dispute system of Arbitrum One. The Arbitrum Foundation stated that this action is part of ongoing proactive security measures aimed at protecting the security and integrity of the network.

Stylus allows developers to write smart contracts using languages such as Rust and C++, while maintaining compatibility with the Ethereum Virtual Machine, with its programs compiled into WebAssembly format. This suspension primarily targets manually written WASM programs that do not use the standard Stylus compiler toolchain and have not yet been patched by the current version of ArbOS. The Security Committee increased the gas required for activation to the theoretical maximum by calling ArbOwner.setWasmActivationGas(2^64 - 1), making new activations economically unfeasible. Activated Stylus contracts are unaffected and can continue to execute and renew, and the deployment and execution of Solidity contracts are also unrestricted.

The newly added BoLD protection allows anyone to pause the settlement from Arbitrum One to Ethereum when two conflicting and accepted answers appear in the same dispute step, which may delay unconfirmed withdrawals to allow the Security Committee to deploy fixes. Officials pointed out that the currently discovered Stylus-related vulnerabilities mainly affect the activity of the chain, such as denial-of-service attacks, and do not jeopardize user funds.