Arbitrum ($ARB) - Independent Verification Review

Command shorthand used in Reproduce columns: cast = Foundry's cast (any install works). ARB1_RPC = https://arb1.arbitrum.io/rpc. NOVA_RPC = https://nova.arbitrum.io/rpc. ETH_RPC = https://ethereum-rpc.publicnode.com.

Verification discipline

Six research lanes (web/headers + agent-readiness, L1 core-contract verification, L2 chain identity/precompiles, governance/security trust model, audits + bug bounty, GitHub/license/status) produced about eighteen load-bearing claims. A separate adversarial pass re-ran ten of the core checks completely fresh (new cast/curl calls, not reused output) before anything below was written.

Tally: 17 CONFIRMED (on-chain, or read directly from Arbitrum's own raw doc source / GitHub / status page) · 1 CORRECTED (a common assumption that ARB is Arbitrum's gas token: it is not; gas on both Arbitrum One and Nova is paid in ETH) · the Security Council's exact multisig threshold (9-of-12 / 7-of-12) is left labelled REPORTED. We confirmed the 12-member, DAO-elected structure from Arbitrum's own concept page directly, but the specific threshold numbers came from secondary governance explainers in this pass, not a raw primary fetch. One coverage gap logged (arbitrum.io's root marketing domain, Cloudflare bot-challenged, logged as their infrastructure, not routed around). Nothing below is speculation; every row carries its reproduce command.

Verdict in plain language

Arbitrum is the real thing it claims to be, and it is unusually well-instrumented about saying so. Every contract we checked (the L1 rollup core, the bridge/inbox/outbox messaging path, the fraud-proof dispute manager) is a live, non-empty contract at exactly the address Arbitrum's own docs publish, and BoLD (permissionless, time-bounded fraud proofs) is live on mainnet with a public 6.4-day dispute window and a 3,600 ETH minimum validator bond, not a roadmap promise. The audit trail is large and current: 43 published reports from four different firms, the newest ten days old at the time of this review, and the $2M Immunefi bug bounty has been running since 2021 and was updated within the last two weeks. What deserves equal prominence with those strengths: the sequencer for both chains is still centralized and Foundation-operated (Arbitrum says so plainly, with a stated worst case of a 24-hour delay/reorder, not a safety break), and Arbitrum Nova is mid-way through a DAO-approved wind-down ("minimization") with a live migration window that closes 2026-09-02. Neither is a defect, both are disclosed, governance-passed decisions at this stage of the roadmap, but a reader holding assets on Nova today needs to know the clock is running. We found no path by which a user loses funds through a defect in what Arbitrum has built or documented.

What we independently confirmed is TRUE

• Arbitrum One and Nova are exactly the chains they claim to be. cast chain-id against the public RPC returns 42161 for Arbitrum One and 42170 for Nova; on Arbitrum One, the ArbSys precompile at 0x0000…0064 independently returns arbChainID() = 42161, two different code paths agreeing.
• ARB is a genuine, correctly-described governance token. 0x912CE59144191C1204E64559FE8253a0e49E6548 on Arbitrum One returns name "Arbitrum", symbol "ARB", 18 decimals, and a live totalSupply() of ~9,999,998,977 ARB, consistent with ARB's publicly known ~10B fixed supply.
• The entire L1 rollup core is real and matches the docs exactly, address for address. We pulled eight addresses (Rollup, Sequencer Inbox, CoreProxyAdmin, Delayed Inbox, Bridge, Outbox, L1 Gateway Router, L1 ERC20 Gateway) directly from docs.arbitrum.io's raw page source, not a summary, and every one resolves to a real, non-empty contract on Ethereum mainnet, re-confirmed on a second, independent pass. The near-identical bytecode sizes among Bridge/Outbox/Delayed Inbox/the two L1 gateways (2,092–2,147 bytes) are consistent with Arbitrum's own documented pattern: minimal upgradeable proxies pointing at shared implementation logic, not one-off deployments.
• BoLD (permissionless fraud proofs) is live, not a roadmap item. The ChallengeManager dispute contract is deployed and non-empty on Ethereum mainnet; Arbitrum's own chain-parameters page states a 45,818-block (~6.4 day) dispute window and a 3,600 ETH minimum validator bond for Arbitrum One, a real, bounded, permissionless challenge path, not a whitelisted validator set.
• The audit trail is large and current, not a stale artifact. 43 listed reports span November 2021 to July 31, 2026 (ten days before this review) from Trail of Bits, OpenZeppelin, ConsenSys Diligence, ChainSecurity, and a Code4rena public competition. We spot-checked three PDF links spanning that whole range (oldest, newest, one from mid-2024) and all three resolved live (HTTP 200).
• The bug bounty is live and current. Immunefi's Arbitrum program has run since August 2021, was last updated July 30, 2026, pays up to $2M for critical smart-contract findings (10% of funds affected, capped), and lists 181 assets in scope.
• The status page is clean at review time. "All systems operational," zero active incidents, zero active maintenance windows.
• Agent-readiness is real, not a token gesture. docs.arbitrum.io publishes a genuinely detailed llms.txt (self-discovered via a Link: rel="service-doc" header on every page) with every documentation page also served as raw markdown at a predictable .md URL, a fully machine-readable docs surface, which is exactly the angle we evaluate every target on.
• Arbitrum has a real, documented agent-payments protocol. The Machine Payments Protocol (MPP) quickstart describes a genuine HTTP-402-shaped flow, challenge → credential → settlement, where a payer (human or AI agent) signs an offline EIP-3009 authorization or a Permit2 witness transfer with no gas and no prior on-chain approval, and the merchant's server settles atomically before serving the response. It is labelled v0.1.0/early by Arbitrum itself, with documented limitations (token-registry scope, decimal handling) stated up front.
• Sequencer centralization is self-disclosed, not buried. Arbitrum's own "State of progressive decentralization" page states plainly: sequencer status is "Centralized... currently maintained by the Arbitrum Foundation," with governance holding the power to replace it, and a stated worst case, the sequencer "can delay the inclusion of a user's transaction by up to 24 hours and reorder transactions over short time-horizons," but "cannot compromise the system's safety or prevent a transaction from ultimately being executed."

The three things worth doing first

1. If you hold assets on Arbitrum Nova, act before 2026-09-02. Nova is in Phase 2 of a DAO-approved "Minimize Arbitrum Nova" migration window (2026-06-04 to 2026-09-02); Nova's own Arbiscan explorer was already deprecated in May 2026. Bridge to Arbitrum One via the canonical bridge now, before Phase 3 deprioritizes support further.
2. Mirror the agent-readiness signal onto the root marketing domain. docs.arbitrum.io is fully open to automated reads and publishes llms.txt; arbitrum.io Cloudflare-challenges even a single plain, non-abusive read (curl and a standard fetch both got HTTP 403). Either relax the challenge for simple GETs or publish a matching llms.txt at the apex domain, so agent/LLM tooling discovering Arbitrum via the marketing site isn't walled off before it ever reaches the docs.
3. Put a one-line human note next to the GitHub license badge. Nitro's LICENSE file correctly states Business Source License 1.1 with a documented conversion path, but GitHub's auto-detected badge shows "Other" / NOASSERTION, which a builder skimming the repo can misread as "no license" or "fully proprietary." A one-line README note ("BUSL-1.1, converts to [X] after the change date, see LICENSE") costs nothing and removes the ambiguity.

Findings

High

None. We found no provable path today by which a user or their funds are compromised through a defect in what Arbitrum has built or published.

Medium

None this pass. Every trust-reducing property we found, centralized sequencer, Security Council emergency powers, the Nova wind-down, is disclosed by Arbitrum in its own docs or governance forum, not something we had to dig for or that contradicts a stated guarantee.

Low

Info

Verifier notes beyond the findings

• The MPP parallel, stated openly, no endorsement implied: Arbitrum's Machine Payments Protocol uses the same core primitive as our own x402 rail, a gasless, offline EIP-3009 transferWithAuthorization signed by the payer, settled atomically by the server on an HTTP 402 request. Seeing a major L2 team publish that exact shape as a first-class quickstart (not just a community wrapper) is a strong signal for the "agent commerce over HTTP 402" thesis broadly, independent of any relationship between the two protocols, there is none.
• BoLD's bond size is a legitimate spam-resistance choice, not a defect. 3,600 ETH to propose an assertion on Arbitrum One is a deliberately high bar for permissionless validation at this stage; it keeps the dispute game economically serious without gating who can challenge a bad assertion (challengers, per BoLD's design, don't need to match that bond).

What we could not check and why

• We did NOT bridge, deposit, trade, or sign anything, passive-only law. The deposit/withdraw path, retryable-ticket delivery, and fraud-proof game were read from docs and confirmed contracts, not exercised.
• We did NOT route around arbitrum.io's Cloudflare bot-challenge. A single plain curl and a single standard fetch both returned HTTP 403 with cf-mitigated: challenge. Logged as their infrastructure decision per our own safety law, not bypassed with modified headers or a headless browser.
• We did NOT independently raw-fetch the Security Council's exact 9-of-12 / 7-of-12 threshold text (I5), our direct fetch of the concept page confirmed the 12-member, DAO-elected structure but not that specific phrase; the threshold figures are REPORTED from secondary sources in this pass.
• We did NOT re-derive BoLD's or Nitro's cryptographic/game-theoretic correctness. We confirmed the dispute contracts are deployed, the parameters (window, bond) are published, and 43 audits exist and are current, not that the implementation is bug-free, which Arbitrum itself names as a "non-zero chance."
• We did NOT independently re-fetch Immunefi's bounty page byte-for-byte. Immunefi is a third-party, JS-rendered page; the $2M/181-asset/last-updated figures came through a rendered fetch, not a raw curl of static HTML.
• We did NOT pull L2BEAT's live Stage classification. Their page didn't return usable content through our fetch tooling this pass; we relied on Arbitrum's own BoLD/permissionless-fraud-proof disclosure instead of an independent third-party stage number.

How to verify this whole document yourself

1. Install Foundry (https://getfoundry.sh) for cast.
2. Chain identity: cast chain-id --rpc-url https://arb1.arbitrum.io/rpc → 42161; cast chain-id --rpc-url https://nova.arbitrum.io/rpc → 42170; cast call 0x0000000000000000000000000000000000000064 "arbChainID()(uint256)" --rpc-url https://arb1.arbitrum.io/rpc → 42161.
3. ARB token: cast call 0x912CE59144191C1204E64559FE8253a0e49E6548 "symbol()(string)" --rpc-url https://arb1.arbitrum.io/rpc → "ARB"; add "totalSupply()(uint256)" for the live supply.
4. L1 core contracts (all on Ethereum mainnet, --rpc-url https://ethereum-rpc.publicnode.com): cast codesize 0x4DCeB440657f21083db8aDd07665f8ddBe1DCfc0 (Rollup), 0x1c479675ad559DC151F6Ec7ed3FbF8ceE79582B6 (Sequencer Inbox), 0x4Dbd4fc535Ac27206064B68FfCf827b0A60BAB3f (Delayed Inbox), 0x8315177aB297bA92A06054cE80a67Ed4DBd7ed3a (Bridge), 0x0B9857ae2D4A3DBe74ffE1d7DF045bb7F96E4840 (Outbox), 0x72Ce9c846789fdB6fC1f34aC4AD25Dd9ef7031ef (L1 Gateway Router), 0xa3A7B6F88361F48403514059F1F16C8E78d60EeC (L1 ERC20 Gateway), 0xA5565d266c3c3Ee90B16Be8A5b13d587ef559fB0 (ChallengeManager), all return non-zero.
5. BoLD parameters: read the chain-parameters reference page → dispute window 45,818 blocks, min bond 3,600 ETH (Arbitrum One).
6. Audits + bug bounty: read the audit-reports page (43 rows); spot-check any PDF link for HTTP 200; read the Immunefi Arbitrum program page for the live bounty terms.
7. Status: curl -s https://status.arbitrum.io/ | grep -o "All systems operational".
8. Agent-readiness: curl -s https://docs.arbitrum.io/llms.txt | head; curl -sI https://arbitrum.io/ vs curl -sI https://docs.arbitrum.io/ for the access-parity gap.
9. MPP: read the Machine Payments Protocol quickstart page.
10. Sequencer trust model: read the "State of progressive decentralization" page (§ Sequencer ownership).
11. The machine record evidence.json beside this file carries every kept finding plus the raw verifier verdicts.

All live values (chain state, audit list, status, bounty terms) were read 2026-08-10 and will drift; the commands above re-read them at any time.

Private - please read before publishing

No finding in this review was classified sensitive. There is no working exploit anywhere in this document, every item describes a governance/trust-disclosure, licensing-clarity, or agent-access observation, not an exploitable break, and nothing was withheld or requires redaction before you share it. I1 (Nova migration deadline), L1 (agent-access parity), and I4 (license badge clarity) are all safe to publish and are useful, actionable items for Arbitrum and for readers holding Nova assets. Nothing here claims adoption, partnership, or endorsement by Offchain Labs or the Arbitrum Foundation.

Prepared by Brandon Kelly - EcoWealth Corporation - brawlaphant@gmail.com - unsolicited, no reply expected, no strings.