A Solana coin moving toward a glowing burn aperture beside validator nodes and a bug report envelope

Firedancer’s New Bug Bounty Makes Researchers Burn 1 SOL Before a Report Can Pay

By Isaac • October 24, 2026 11:13 pm • Comments

Firedancer has put a literal price on getting a security report into its bug-bounty pipeline.

Under terms that took effect October 18, a researcher must burn 1 SOL before a report can qualify for a payout. That burn is permanent and is not refunded when the report turns out to be invalid, outside the program’s scope, or a duplicate of a vulnerability someone else found first.

The terms also require an end-to-end proof of concept against an allowed branch and configuration, with practical impact and a clear attacker model. After the burn is confirmed, the team says a researcher should receive initial contact through a GitHub Security Advisory within 96 hours; decisions and fixes can take longer.

Trending: Coinbase’s GYEN Conversion Creates a Three-Deadline Choice for Holders

Current rewards are doubled through November 20, and Alpenglow-specific findings qualify for triple standard payouts. The program generally favors the first report, while preserving discretion for later work that shows greater impact, corrects an incomplete submission, or adds exceptional value.

The rule is meant to discourage spam and low-effort submissions. But it also shifts a real piece of the program’s screening cost onto researchers, including people whose work may identify a genuine flaw but arrive second.

Firedancer’s submission page says the report form unlocks after the required burn transaction is detected. A report without that burn may still be reviewed, but it cannot earn a bounty.

The important distinction is that the SOL is burned, not paid to Jump Crypto as fee revenue. The token goes to an incinerator wallet and cannot be recovered. For the researcher, however, the economic result is the same: every eligible attempt begins with a non-refundable cost.

Firedancer is balancing that hurdle with temporarily richer rewards. Eligible findings receive twice the standard payout through November 20, while findings specific to Solana’s Alpenglow consensus system receive three times the normal amount.

The published ranges put critical findings as high as $200,000 under the double-reward schedule or $300,000 when the Alpenglow multiplier applies.

The sharpest edge of the new policy is its treatment of duplicates. The current terms generally favor the first report covering an issue or a closely related variant.

A later researcher can still be recognized when that report demonstrates greater impact, covers a wider attack surface, corrects bad assumptions in the first submission, or provides unusually strong work.

That means a later report can be valuable and still leave its author out 1 SOL. The project has preserved discretion to pay for high-quality follow-up work, but the burn itself remains non-refundable either way.

CryptoSlate’s review of the change noted that the spring audit contest treated eligible duplicates more generously. It also pointed to Jump Crypto’s retrospective, which said slower review helped produce repeated discoveries while earlier reports were waiting for action.

The new terms promise initial contact through a GitHub Security Advisory within 96 hours after a confirmed burn. That is an initial-response target, not a deadline for validating or fixing the vulnerability.

The extra Alpenglow payout is not an abstract bonus. Solana’s new consensus protocol has now gone live on mainnet-beta, making careful testing of consensus behavior immediately relevant to the network rather than a future exercise.

Firedancer’s independent validator implementation is intended to strengthen Solana by reducing dependence on one codebase. That makes serious vulnerability research especially valuable.

The question is whether charging every prospective finder 1 SOL filters out noise without also deterring useful reports from independent researchers who cannot know whether someone else privately submitted the same bug hours earlier.

For well-funded security teams, the burn may be a manageable anti-spam toll. For smaller researchers, it is a risk calculation before the technical merits of their work have even been reviewed.

The larger temporary payouts make the upside clear. The non-refundable duplicate rule makes the downside just as clear.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews