Researchers reporting security flaws in Firedancer must now burn 1 SOL with every submission, under bounty terms that took effect on Monday. The fee is non-refundable, including for duplicate, out-of-scope or invalid reports, and reports sent without a burn “will not be eligible for a bounty”.
Firedancer is a so-called validator client, the software that the computers securing Solana run to process and vote on blocks. It is built by Jump Crypto as an alternative to the original Agave client. Burning a token means sending it to an address no one controls, which takes it out of circulation for good.
Jump explained the change in a 16 Oct post by Ishan Bhatt. A 30-day public contest this spring, with a $1 million pool and a $100 entry fee, brought in 809 reports from 162 researchers. Only 127 were unique security findings, and nearly half of the valid reports were duplicates, the post said.
The reports were also getting longer. Excluding code and formatting, the average contest report ran to 1,064 words, against 406 words for reports to Jump’s bounties before 2025. At about 26 submissions a day, the open queue peaked at 299 reports.
“AI has made finding bugs cheap, but judging them is still expensive,” Bhatt wrote.
Why it matters: Firedancer secured 15% of Solana’s stake when the post was written, according to Jump, and its bounty now covers only Alpenglow, Solana’s new consensus protocol. Since Alpenglow went live on mainnet, a bug in that code is a bug in how the chain finalises blocks. We covered the switch in our 24 Oct Chain Check.
What researchers have to do
Only the Alpenglow configuration is in scope, the terms say. Reports about Tower BFT, Solana’s old voting system, are out, because no cluster runs it any more.
Until 20 Nov, eligible reports earn twice the standard payout, and Alpenglow-specific findings earn three times. A critical bug, such as one that leads to a loss of funds, normally pays $50,000 to $100,000. A critical Alpenglow bug pays $150,000 to $300,000 during the boost.
Each report must cover one vulnerability with clear steps to reproduce it. Researchers who confirm their burn should hear back through a GitHub Security Advisory within 96 hours, according to the terms. CoinDesk also reported the change.
SOL was trading at $100.17 at about 10:49 UTC, down about 0.6% from the UTC-day open, according to Kraken. The boosted payouts end on 20 Nov.
This article is for information only and is not investment advice.