Moderate risk — centralized sequencer and Security Council emergency powers create trust assumptions, balanced by a clean 4+ year track record, permissionless fraud proofs (BOLD), and deep ecosystem adoption.
Risk Breakdown
Top Risks
The Security Council (9-of-12 multisig) can perform emergency upgrades to all Arbitrum contracts without any timelock delay, creating a centralization risk where a compromised or coerced council could alter the rollup's behavior instantly. The DAO has published the council member identities and an election process to mitigate this.
Arbitrum relies on a centralized sequencer operated by Offchain Labs to order and batch transactions before posting to Ethereum. If the sequencer goes down or censors transactions, users must wait for the delayed inbox mechanism to force-include transactions on L1, creating temporary liveness and censorship resistance concerns.
The BOLD dispute protocol enables permissionless fraud proofs but the system is still Stage 1 on L2BEAT, meaning the Security Council retains override powers. A coordinated council action could theoretically finalize an invalid state root, though this would require 9 of 12 members to collude.
ARB token has significant upcoming unlock pressure with ~4B tokens still vesting through March 2027, including team and investor allocations, which could create sustained sell pressure on the governance token.
Frequently Asked Questions
Is Arbitrum safe to use?
What are the main risks of using Arbitrum?
What is Arbitrum's risk score breakdown?
How does Arbitrum compare to other L2 protocols?
Has Arbitrum ever been hacked or exploited?
Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.