The pattern repeating across Bitcoin L2s this year—Coldcard vulnerabilities, Lightning edge cases, the Liquid federation exploit—has a common root: custom execution environments accumulate security debt faster than teams can audit them.
Arbitrum Stylus takes the opposite bet. Instead of building another bespoke VM, they're bringing WebAssembly to EVM chains. That means Rust, C, C++—languages with decades of tooling, auditing infrastructure, and developer muscle memory.
Summary
Stylus lets developers write smart contracts in Rust, C, or C++ that compile to WASM and run alongside EVM contracts on Arbitrum. The same contract can call EVM contracts and be called by them—full interoperability. The core bet: WASM's 10-100x performance improvement over EVM enables new categories of onchain applications, while mature language tooling reduces security footguns.
What is Stylus?
The EVM is a 256-bit stack machine designed in 2014. It works, but it's slow, gas-expensive for computation, and forces developers to learn Solidity—a language that exists nowhere else.
Stylus adds a WASM virtual machine running parallel to the EVM:
Arbitrum One Architecture (with Stylus):
┌─────────────────────────────────────────────────┐
│ User Transactions │
├─────────────────────────────────────────────────┤
│ Arbitrum Nitro Execution │
│ ┌───────────────┬───────────────────────────┐ │
│ │ EVM │ WASM (Stylus) │ │
│ │ (Solidity) │ (Rust, C, C++) │ │
│ │ │ │ │
│ │ Existing │ 10-100x faster │ │
│ │ contracts │ computation │ │
│ └───────────────┴───────────────────────────┘ │
│ ↕ Full Interoperability ↕ │
├─────────────────────────────────────────────────┤
│ Shared State / Storage │
└─────────────────────────────────────────────────┘A Stylus contract can call an EVM contract. An EVM contract can call a Stylus contract. They share the same state. From the user's perspective, there's no difference.
The Language Accessibility Bet
Here's what I'd underwrite: the biggest constraint on onchain development isn't gas costs—it's the developer pool.
Solidity developers are maybe 50,000 people globally. Rust developers? 3 million+. C/C++ developers? 10 million+. Stylus doesn't just improve performance; it makes smart contract development accessible to developers who've never touched crypto.
Developer Pool Comparison:
Solidity:
- ~50K developers
- Niche tooling
- Limited audit capacity
- Security patterns still evolving
Rust (with Stylus):
- ~3M developers
- Mature tooling (cargo, clippy, miri)
- Large security audit industry
- Decades of battle-tested patternsI've watched enterprise teams bounce off Solidity because their security review process doesn't know how to evaluate it. Rust is a different story—they have Rust auditors, Rust static analysis, Rust fuzzing infrastructure. The compliance path is clearer.
Impact
Computational workloads become viable. Onchain machine learning inference? Image processing? Complex simulations? The EVM can't do these economically. WASM can. A cryptographic operation that costs 1M gas in EVM might cost 50K in Stylus.
Memory efficiency unlocks new data structures. EVM storage is 256-bit words, which is wasteful for most data. WASM has byte-addressable memory. You can implement proper hashmaps, trees, and compression algorithms.
The security tooling advantage is underrated. Rust's borrow checker catches entire classes of bugs at compile time. cargo audit checks for known vulnerabilities in dependencies. These tools don't exist for Solidity at the same maturity level.
But ecosystem fragmentation is real. Now you have two languages to audit, two sets of patterns to learn, two codebases that can interact in unexpected ways. Cross-language reentrancy attacks are a new threat model.
Failure Modes
WASM-EVM Boundary Attacks: The interop layer between WASM and EVM is novel code. Every boundary crossing is a potential security gap. What happens when a WASM contract calls an EVM contract that calls back into a different WASM contract? The call stack semantics need to be bulletproof.
Gas Metering Discrepancies: WASM and EVM have different execution models. Gas metering for WASM is new and hasn't been battle-tested. An operation that looks cheap might have hidden computational complexity that the gas model doesn't capture.
Memory Safety Doesn't Mean Logic Safety: Rust prevents memory bugs, not business logic bugs. A perfectly memory-safe contract can still have economic exploits, oracle manipulation vulnerabilities, or governance attacks.
Tooling Lag: Most Solidity security tools—Slither, Mythril, Echidna—don't work with Stylus. The Rust security tooling exists but hasn't been adapted for smart contract patterns. There's a gap before the tooling catches up.
What I'd Change
Ship with conservative gas multipliers. Until WASM gas metering is battle-tested, charge 2x what the model suggests. Better to be expensive and secure than cheap and exploitable. Lower the multiplier as confidence grows.
Build cross-language call graphs. Security auditors need to see the full call graph across WASM and EVM contracts. Build tooling that traces cross-language calls and highlights boundary crossings.
Standardize WASM contract patterns. The Solidity ecosystem has OpenZeppelin for standard patterns. Build the equivalent for Stylus—audited base contracts for common functionality.
Require dual-audit for cross-language systems. Any system that mixes WASM and EVM contracts should require auditors familiar with both. The boundary is where bugs hide.
Lessons
-
Language accessibility is infrastructure. Making smart contracts writable in mainstream languages isn't just a developer convenience—it's a security advantage because it unlocks existing audit capacity.
-
Performance unlocks new applications. 10-100x improvements aren't incremental—they enable qualitatively different use cases. Onchain ML, complex games, and real-time systems become possible.
-
Boundaries are where bugs live. Any time two systems interact—WASM and EVM, L2 and L1, onchain and offchain—the interaction layer is the highest-risk code.
-
Tooling maturity takes time. Stylus inherits Rust's tooling, but smart contract-specific tooling needs to be built. Budget time for the ecosystem to catch up.
-
Complexity reduction in one dimension often adds complexity elsewhere. Stylus reduces execution complexity by using mature VMs. But it adds integration complexity with the dual-execution model.
If you're building computationally intensive onchain applications, Stylus is worth serious evaluation. The performance gains are real. Just make sure your security process can handle the cross-language surface area.