In this article5 sections
Solana’s Firedancer validator client now charges researchers a non-refundable burn of 1 SOL, worth roughly $100, with every bug bounty submission, Bitcoinist reported. The team behind the Jump Crypto-built software introduced the fee to slow a wave of AI-assisted reports that had been consuming engineers’ review time.
The burned tokens are permanently removed from circulation, and the cost is not returned whether a submission is invalid, outside scope, or a duplicate, according to Bitcoinist. Cryptobriefing reported that the policy took effect on October 18, 2026, and that no one, including Jump Crypto, collects the fee.
Also readSolana's Alpenglow Upgrade Goes Live, Pulling Validator Votes From Blocks
Key facts
- Every Firedancer submission must carry a 1 SOL burn (about $100) that is permanently destroyed; reports without it can be reviewed but earn no payout, Cryptobriefing reported.
- A $1 million audit contest held April 9 to May 9 attracted 809 reports from 162 researchers but yielded only 127 unique security findings once non-exploitable observations were excluded.
- Nearly half of the valid submissions were duplicates, and Jump’s Oct. 16 review by Ishan Bhatt noted the backlog peaked at 299 open reports.
- Payouts are doubled through Nov. 20, and Alpenglow-specific bugs earn triple the standard amount.
- Critical flaws in Alpenglow, Solana’s new voting system, can qualify for up to $300,000, a ceiling set at the team’s discretion.
Why Firedancer’s reviews were clogged
Firedancer is an alternative to Agave, the main client validators use to process Solana transactions. A serious flaw in either could stop validators from processing payments or cause them to disagree about account balances, disrupting trades and transfers across the network. Jump’s Ishan Bhatt argued in the Oct. 16 review that AI has made finding bugs cheap while judging them stays expensive, since engineers still had to reproduce each reported problem and test whether the proposed attack worked.
Some submissions flagged apparent weaknesses while missing protections elsewhere in the code. As the queue slowed, other researchers rediscovered bugs that had already been submitted but not yet fixed or disclosed, and about 80% of duplicates arrived more than three days after the original report. The earlier contest already charged $100 per entry and limited researchers to one report a day.
Also readDecrypt Money Accounts Go Live on Solana for Earn, Perps and Swaps
Higher rewards tied to Alpenglow
Cryptobriefing reported that Alpenglow, Solana’s consensus overhaul, went live on mainnet on October 21, 2026, days after the new bounty rules took effect, which helps explain the triple multiplier for that code. The standard doubled payout schedule ends November 20, 2026. The new platform also caps each main report section at 3,000 characters, per Bitcoinist.
Why it matters
Firedancer exists so that Solana does not depend on a single client, a resilience strategy in which one team’s flaw is less likely to be catastrophic. That only holds if each client’s own bug bounty pipeline works, so the quality of reviews feeds directly into how sturdy the network is. Cryptobriefing noted the burn is technically deflationary, though bug report volume will not shift SOL’s circulation meaningfully.
The template may travel: Crypto projects that rely on outside researchers face the same flood of cheap AI-written reports, and charging for submissions while raising rewards for valuable ones is one way to separate serious hunters from opportunists. The trade-offs are real. Cryptobriefing noted the fee could deter newer or less-funded researchers, and even honest finders pay when someone else reported the bug first.
What to watch
The next checkpoint is November 20, 2026, when the doubled standard payouts are scheduled to end. How many reports arrive before then, and how many are genuine, will be the clearest test of whether the fee solves the spam problem it was built to address.
This is not financial advice. Cryptocurrency markets are volatile and uncertain, and nothing here should be read as a recommendation.
Sources: Bitcoinist, Cryptobriefing
