Arbitrum’s BoLD flips the switch on permissionless L2s

Breaking: the day validation opened

On February 12, 2025, Arbitrum activated its BoLD dispute protocol on Arbitrum One and Nova and did something rollups had promised for years but had not delivered at scale. It removed the validator allowlist and let anyone with the skills and capital verify, propose, and challenge the chain’s state. BoLD stands for Bounded Liquidity Delay, and it is the engine that makes this shift safe by bounding how long a dispute can delay finality. The upgrade also adds one more challenge period to withdrawals by design, trading a little extra wait for stronger guarantees. You can read the launch details and timing in the official documentation, which also notes the default challenge period of about 6.4 days and the additional delay for withdrawals after BoLD is enabled. Arbitrum’s BoLD launch details.

If you have felt the ground move beneath Layer 2, you are not imagining it. Allowlists are out, permissionless validation is in, and the race to Stage 2 has begun in the open.

What BoLD changes, in plain English

Think of the old world as a fenced court with a small crew of referees. Only those refs could blow the whistle on a bad play. If they were asleep or conflicted, the bad call could stand for a long time. BoLD turns the court into an open stadium where anyone can step in, blow the whistle, and get paid if they help the right side win.

Here is the mechanism, stripped of jargon:

Anyone can verify the chain as a watchtower. That is free. You run a node, you check assertions, you sound the alarm if something looks wrong.
If you want to push the chain forward or challenge a claim, you bond capital. Those bonds discourage spam and griefing. If you lie, the protocol takes your bond. If you tell the truth, you get it back.
Disputes used to line up like one on one duels. A malicious party could keep opening new fights and slow everything down. BoLD lets the good party fight all comers in parallel, and it sets a fixed clock for the entire fight. Honest disputers always win given deterministic execution, so timeboxing is safe.
The chain needs only one live proposer to keep making progress. Everyone else can watch and be ready to challenge. That reduces the reliance on any single team or multisig.
If a bad claim appears, honest challengers can bond in and defend the correct state. On Arbitrum One, there is a defined bounty for defenders, plus reimbursement of onchain gas for honest defense. Bonds from malicious parties are confiscated.

Two practical side effects matter for users and builders:

The default challenge period is about 6.4 days. Because BoLD turns the defense into a bounded game, withdrawals pick up an additional challenge period to cover the resolution window. That lengthens exits but removes the prior risk that a failing or malicious allowlisted validator could stall exits indefinitely.
The protocol gives clear economic roles. Proposers earn a service fee paid by governance to compensate for capital at risk. Challengers who defend correctly can receive a defined share of seized funds. That makes watching and challenging a real business, not a charity.

The result is a different trust model. You do not trust a small set of allowlisted validators to be awake and benevolent. You trust that at least one honest verifier exists and can afford to act. That is a simple, testable assumption.

For how this fits into broader Ethereum architecture shifts, see our take on Celo L1 to L2 consolidation.

Stage 2, explained without jargon

Much of the conversation uses Stage 0, Stage 1, and Stage 2 as shorthand. These terms come from a community framework maintained by L2BEAT. Here is the essence:

Stage 1 means permissionless proofs are live and a decentralized security council stands behind the system. Users should be able to exit without asking a team for help, and emergency powers are limited by design.
Stage 2 means the training wheels are essentially off. Fraud or validity proofs are fully permissionless, the security council is restricted to acting on onchain detectable bugs, and users get at least 30 days to exit after unwanted upgrades. The system is governed by code, not by discretionary human decisions.

If you want the full criteria, the L2BEAT explainer is short and very clear. L2BEAT’s Stages Framework.

BoLD makes it realistic for Arbitrum chains to meet the Stage 2 bar on the proof side, because it removes the allowlist and timeboxes disputes. The rest of Stage 2 is governance and exit policy. That is why the upgrade is both a technical and a political milestone.

Why BoLD rewrites Layer 2 trust assumptions

Rollups are about minimizing new trust while reusing Ethereum’s security. For years, the gap between the idea and the reality was the allowlist. If only a handful of parties could dispute state, users had to trust those parties to be attentive and independent. In extreme cases, a captured or asleep allowlist could allow an invalid state to pass or prevent withdrawals for a long time.

By making verification and challenges open, BoLD narrows the trust surface to a single honest actor assumption, a standard cryptoeconomic model that risk teams can actually price. Several consequences follow:

Exits become stoppable only by code. With open disputers and a fixed dispute window, an attacker cannot drag out a dispute forever to freeze funds. Worst case, a user waits through the extra window and still exits.
Bridge risk gets simpler. Under allowlists, bridge operators often added central backstops or emergency pause levers to cover the risk that proofs would not be honored. With permissionless challengers and known timelines, bridges can scale back discretionary controls and price liquidity on a tighter distribution of exit times.
Custody and exchange risk change. A custodian that integrates an L2 can now cite open proofs and bounded dispute times in its risk memo, rather than a named list of validators and informal assurances. That reduces key person risk and makes audits easier.
Operator incentives improve. The protocol pays honest proposers a service fee and rewards honest defenders, so the job of securing the chain is not a public good forever. Markets can emerge for pooled bonds, watchdog services, and challenger infrastructure. For a related shift in security economics, see Restaking meets L2 reality.

The previous world was like relying on a private security guard at the door. The new world is like installing alarms that any neighbor can trigger and a camera that records everything. A guard can still help, but they are no longer the only line of defense.

The competitive clock starts now

BoLD is not happening in a vacuum. Optimistic rollups built on the OP Stack, including Optimism’s OP Mainnet and Coinbase’s Base, spent the last year shipping permissionless fault proofs and moving to decentralized councils. They meet Stage 1 today, and they made meaningful progress on proposer openness and challenges. Zero knowledge rollups pushed forward too. Scroll’s Euclid upgrade, shipped in April 2025, added enforced inclusion and permissionless batch submission and cleared the Stage 1 bar. Starknet reached Stage 1 in mid May 2025 by tightening its governance and clarifying its validity proof pathway. zkSync Era has been working through a set of governance and client upgrades, with the stated goal to reach Stage 1 and beyond.

Now the bar is higher. With Arbitrum’s disputers fully permissionless on flagship chains, and a clear path to Stage 2 on the proof side, the next competitive frontier is governance. Over the next 6 to 12 months, pressure will mount on every major rollup team to:

Offer a real exit window after upgrades. Thirty days is the target in the Stage 2 framework. This is not a nice to have. It is how users know they can opt out safely when code changes.
Restrict the emergency council. Councils should only act when an onchain detectable bug exists. Anything broader invites controversy and undercuts the point of decentralization.
Demonstrate independent challengers in the wild. Teams should help boot challengers run, then step back. A healthy ecosystem has many watchdogs with different incentives and geographies.

If you build on OP Stack, the good news is that permissionless proofs are already live and battle tested. The delta to Stage 2 is now governance structure, upgrade pipelines, and longer exit windows. If you build on zk systems, your proofs are inherently permissionless, but the same governance and exit principles apply. For a performance-focused benchmark on another stack, see our Polygon Rio goes live analysis.

What changes for users, concretely

Check the withdrawal timers. On Arbitrum, BoLD adds an extra challenge period to withdrawals. Plan liquidity around that longer exit path. It is a cost, and it buys you predictable, unstoppable exits.
Favor apps that assume no trusted validator. When a wallet or a DeFi app explains how it handles L2 risk, look for language about open challengers, watchtower diversity, and fallback exits via the canonical bridge. Avoid apps that depend on a team operated multisig to get funds back.
Keep an L1 address handy. If your L2 account is compromised or your wallet breaks, the safest fallback is often a withdrawal to an L1 address you control. Make sure you have one and you know how to use it.
Watch for challenger markets. Over time, you will see staking like products that fund challengers and proposers and pay a yield from fees and bounties. Treat them like any other risk product. Read the slashing rules, the liquidity backstops, and the jurisdictional requirements for payouts.

What changes for DeFi risk models

Risk teams can and should update their playbooks this quarter.

Replace the allowlist assumption with a one honest challenger assumption. Model the probability that no honest challenger acts during the dispute window. That is the true residual risk of an invalid withdrawal.
Update exit time distributions. With a fixed additional dispute window, you can move from a fat tail to a bounded distribution. This helps size bridge liquidity and market maker inventories. It also affects pricing for instant exit products.
Monitor L1 assertions, not tweets. Instrument alerts on the L1 bridge contracts and assertion trees. Treat the canonical bridge and the L1 contracts as the source of truth. Write runbooks that escalate when assertions are challenged.
Adjust counterparty lists. If an app uses a non canonical bridge or a third party custodian, check whether it can complete exits using only onchain logic even when that counterparty disappears. Reward designs that do not assume friendly operators.
Price council risk as governance risk. If a chain still has broad council powers or instant upgrades, add a governance haircut. Stage 2 style councils reduce this haircut because their powers are narrower and easier to audit.

What changes for institutions

Stronger audit narratives. Instead of describing a team controlled allowlist and soft commitments, your audit and compliance documents can cite open proofs, a bounded challenge window, and a clear exit policy. That supports internal control assertions and reduces reliance on vendor representations.
New vendor requirements. If you rely on a custodian or an infrastructure provider for L2 operations, add challenger capability to your vendor checklist. Either they run challengers or they contract with a third party who does. Ask for evidence.
Updated liquidity policies. The extra challenge period on exits affects treasury operations. Redraw your buffers and concentration limits so you can meet obligations during extended exit windows without fire sales.
Insurance and capital charges. A well specified, bounded exit risk is easier to insure and cheaper to capitalize. Bring the BoLD timeline into your capital models and push your underwriters to recognize the improvement.

Open questions that deserve attention

Bounties and compliance. Defender bounties on Arbitrum One require know your customer checks and DAO votes to pay from seized funds. That is practical, but it adds friction for independent watchdogs. Expect businesses to emerge that aggregate claims and handle the governance overhead.
Bond sizing. Bonds need to be large enough to deter grief, small enough that honest parties can afford to act. Over time, expect pooled bonds and credit providers to appear. That introduces its own concentration risks, which governance must watch.
Sequencing fairness. Permissionless validation is a huge step. It does not decide how transactions are ordered by sequencers. Expect continued debate about priority auctions, fairness, and censorship resistance at the mempool layer.
Stage 2 governance details. The 30 day exit rule and the bug only emergency powers are clear in principle. The devil is in implementation. Chains will need upgrade pipelines that respect exit windows without freezing real fixes. Tooling for queued upgrades and clear user notices will matter.

How teams can get to Stage 2 faster

Publish an exit window policy. Put a date and a number on it. If you plan to give users 30 days to exit after any upgrade they did not vote for, say so now and wire it into your contracts.
Lock emergency powers to onchain detectable bugs. Codify the triggers, the time bounds, and the audit trail. The narrower the power, the easier it is for users to trust it.
Help challengers, then step back. Fund independent challengers at the start, open source all tooling, and create public dashboards. When a dispute happens, independent actors should show up first.
Run tabletop exercises. Simulate an invalid assertion, a mass exit, and a bug fix under a 30 day exit window. Publish what you learned. This turns fuzzy trust into observable competence.
Make withdrawals boring. Add clear timers to bridges, pre fund exit liquidity providers with programmatic rules, and make sure users never need a support ticket to complete an exit.

The takeaway

With BoLD live on Arbitrum, permissionless validation is no longer a promise. It is an operating reality with dates, bonds, and economics. That changes what users must trust, what risk teams can model, and what institutions can sign off. It also moves the goalposts for everyone else. Over the next 6 to 12 months, rollups that want to win developer mindshare and institutional capital will match the proof openness and push governance toward Stage 2. The prize is not a buzzword. The prize is a network where exits are unstoppable, upgrades are predictable, and the only thing you have to believe is that one honest actor will show up. In crypto, that is as close to a sure thing as you will ever get.