Firedancer, Jump Crypto's independent validator software for Solana, implemented a new bug bounty policy effective October 18 requiring researchers to burn 1 SOL to qualify for rewards. The burn is non-refundable even when a report identifies a real vulnerability that another researcher submitted first.
The change represents a narrower path to payment compared with Firedancer's spring audit contest, which ran from April 9 to May 9, 2026. That earlier contest charged $100 per report and allowed duplicate submissions of unfixed bugs to remain eligible for rewards once a fix was publicly disclosed. Under current terms, the first submission generally receives the reward, though the team preserves discretionary rewards for some later reports.
Jump Crypto attributed the policy shift to operational challenges during the spring contest. According to Ishan Bhatt's October 16 retrospective, the contest received 809 total submissions from 162 researchers, with 127 unique security submissions outside the contest's insight category. Nearly half of valid submissions were duplicates, with roughly 80 percent of duplicate submissions arriving more than three days after the primary report.
Bhatt described a feedback loop in which earlier findings remained unfixed or undisclosed while review lagged, allowing other researchers to discover and submit the same problems. The backlog peaked at 299 open reports with submissions arriving at roughly 26 per day. As the team's triage process caught up, duplicate submissions declined.
Bounty Terms and Eligibility
The submission form describes the 1 SOL burn as an irreversible transfer to an incinerator wallet, which Jump Crypto does not collect as fee revenue. Reports without a burn may or may not be reviewed but cannot receive a bounty under the terms.
Eligibility extends beyond duplicate status. The terms treat relevant public repository material, including code comments, pull requests and mitigating changes on public branches, as known issues. Privately known issues that demonstrably predate a report receive case-by-case consideration.
Firedancer is temporarily increasing rewards through November 20, 2026. Eligible findings receive twice the standard payout, or three times the standard payout for Alpenglow consensus findings. Findings affecting only pre-Alpenglow consensus receive greatly reduced discretionary rewards.
The team expects initial contact through a GitHub Security Advisory within 96 hours after submission and confirmation of the required burn, though no deadline applies to validating the attack, preparing a patch, or deploying a fix.
