Arbitrum Governance and Stylus Updates: July 2026 Technical Overview

ArbOS 61 Elara activates on Arbitrum One and Nova, quadrupling the Stylus smart contract code size limit from 24 KB to 96 KB. A separate constitutional proposal restructures Security Council elections. Both proposals passed Snapshot and move to on-chain confirmation. For developers targeting Stylus, the expanded binary ceiling changes deployment architecture decisions immediately.

Stylus Code Limit: 4x Surface Expansion

The code size limit lift from 24 KB to 96 KB removes a hard constraint on Stylus contract complexity. At 24 KB, developers hit tight compile targets for anything beyond basic WASM modules. 96 KB permits multi-library architectures, richer state mutation logic, and more aggressive inlining of security checks without manual code golfing.

The expanded ceiling also increases the attack surface per deployment. More code means more instruction paths, more deterministic execution branches to audit. The invariant holds: code expansion demands proportional review rigor. Every additional kilobyte is a potential attack vector. Size is not safety.

Security Council Election Overhaul

The approved constitutional proposal restructures Arbitrum's Security Council election process with several key changes:

• Term extension. Cohort terms shift from one year to two years. Elections move to an annual cadence each March.
• Lowered nomination threshold. Qualification drops from 0.2% to 0.1% of votable ARB, broadening the candidate pool.
• Key rotation procedures. Candidates can update security keys during compliance phases. Active members may self-rotate keys during their term subject to an 18-day timelock.
• No incumbent bypass. A proposed rule allowing sitting members to skip nomination was omitted after delegate feedback. Fresh community endorsement remains mandatory each cycle.

Current member terms adjust retroactively. Next Security Council election: March 2027.

Governance Attack Economics

A separate data point calibrates the stakes. A hacker spent approximately $4 million to acquire sufficient voting power and pass a malicious governance proposal on BonkDAO, draining $20 million from the treasury. No smart contract vulnerability was exploited. The attack vector was pure governance — capital-weighted influence, not code failure. The acquisition cost exceeds the entire prize pool at the Honor of Kings EWC mobile esports showdown, yet the return dwarfed it fivefold.

The $4M-to-$20M cost-to-drain ratio illustrates governance attack economics at scale. Capital concentration in token-weighted voting creates deterministic paths for treasury extraction. Arbitrum's Security Council reforms — lower thresholds, longer terms, mandatory key rotation — are a direct structural response to this class of risk. Whether the new invariant holds under adversarial pressure remains the open question.

What to Verify

• Deploying Stylus contracts above 24 KB: audit scope scales with binary size. No exceptions.
• Holding ARB governance positions: Security Council election cadence changes affect term planning and key management schedules.
• Building governance mechanisms: the BonkDAO exploit confirms that capital-weighted voting without quadratic safeguards or timelock vetoes is a known, reproducible attack vector. Budget accordingly.