3 hours ago
38
Want to report a bug in Solana’s Firedancer software? Bring 1 SOL, worth about $100, and expect to never see it again.
The team behind Firedancer, the Solana validator client built by Jump Crypto, now requires researchers to burn 1 SOL with every bug bounty submission. The goal is to stem a flood of AI-assisted reports that has been eating up engineers’ time. Call it a cover charge for the security club.
How the new bounty rules work
The policy took effect on October 18, 2026. Every submission must come with a non-refundable burn of 1 SOL.
Burning a token means sending it somewhere it can never be retrieved or spent. The coins are permanently removed from circulation. Nobody pockets the fee, including Jump Crypto.
The rule covers every report, with no exceptions. That includes duplicates, and even submissions that flag a genuine issue someone else already reported.
Researchers who skip the burn are not completely shut out. Their reports can still be reviewed. They just won’t be eligible for any payout.
The stated aim is to cut spam and free up engineers to dig into real security flaws. The fee gives submitters a reason to check their work first, a modest deterrent for anyone hoping to paste chatbot output into a form and hope for a payday.
The carrot that comes with the stick
Jump Crypto is pairing the fee with a temporary bump in rewards. Standard payouts are doubled until November 20, 2026.
Findings tied to Alpenglow get even richer treatment. Those reports can earn triple the standard amounts.
Critical flaws in Alpenglow’s voting system could fetch as much as $300,000. That top figure is at the team’s discretion, so it is a ceiling rather than a guarantee.
The timing is not accidental. Solana’s Alpenglow consensus went live on mainnet on October 21, 2026, just days after the new bounty rules kicked in.
Consensus is the process by which a network’s validators agree on which transactions are valid and in what order. Think of it as the jury deliberation room of a blockchain. A flaw there is a far bigger problem than a typo in a user interface.
That explains why Alpenglow findings carry the triple multiplier. Fresh consensus code running with real money on the line is exactly where defenders want the most experienced eyes.
What pushed Jump Crypto here
The fee did not come out of nowhere. The Firedancer team previously ran a public audit contest from April 9 to May 9, 2026.
That contest drew 809 submissions from 162 researchers. Only 127 of them turned out to be unique security findings.
Nearly half of the reports were duplicates. The review backlog peaked at 299 open reports during the event.
Jump Crypto’s revised program was shaped by the observation that many of those reports appeared to be AI-assisted or AI-generated. The experience from the earlier contest informed the stricter policy now in place.
The arithmetic is unflattering. A security team triaging hundreds of reports to surface a fraction of real findings is spending most of its hours saying “already known” or “not a bug.” That is time not spent fixing actual problems.
AI tools have made it cheap to generate plausible-sounding vulnerability write-ups at scale. When producing a report costs almost nothing, the incentive is to submit everything and let the reviewers sort it out. The 1 SOL burn flips that math by giving every submission a real price tag.
Why Firedancer matters to Solana
Firedancer is an independent validator client for Solana. A validator client is the software that node operators run to process transactions and participate in consensus.
Running more than one independent client is a resilience strategy. If a single piece of software powers an entire network, one bug can take the whole thing down. With multiple clients written by separate teams, a flaw in one is less likely to be catastrophic.
That only works if each client is secure in its own right. So the quality of Firedancer’s bug bounty pipeline is not a niche engineering concern. It feeds directly into how sturdy Solana is overall.
What this means for researchers, SOL holders and other projects
For security researchers, the change separates serious hunters from opportunists. A skilled auditor who finds a real Alpenglow flaw stands to earn triple rewards, with critical issues potentially reaching $300,000. Against that upside, a roughly $100 entry fee is a minor cost of doing business.
The pain lands on low-effort submitters, and on honest researchers who happen to find something already reported. Because duplicates still require the burn, even good-faith work can cost money if someone else got there first. That adds a new layer of risk for researchers working on popular areas of the code.
For SOL holders, the burn mechanism is technically deflationary, since every submission permanently removes a token from supply. Realistically, though, bug report volume will never move the needle on SOL’s overall circulation. The more meaningful signal is about security posture.
A network that just switched on a new consensus system is in a sensitive window. Tighter triage and bigger rewards suggest Jump Crypto is trying to concentrate scrutiny where it counts. Whether that translates into fewer incidents is something only time and Alpenglow’s track record will show.
The bigger story may be the precedent. AI-generated noise is a problem for any open bounty program, and plenty of crypto projects rely on outside researchers to find flaws before attackers do. Firedancer’s approach offers one template: make submissions cost something, then raise the rewards for work that is actually valuable.
There are trade-offs worth watching. A paywall could discourage newer or less-funded researchers who might otherwise contribute. It could also nudge some finders toward sitting on bugs rather than reporting them, though the boosted payouts are designed to counter exactly that temptation.
The next checkpoint is November 20, 2026, when the doubled standard payouts are scheduled to end. How many reports come in before then, and how many of them are genuine, will be the clearest test of whether charging for submissions actually solves the spam problem it was built to fix.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
English (US) ·