Researchers submitting bug reports for Firedancer, the Solana validator software built by Jump Crypto, must now permanently burn 1 SOL, worth about $100, for each submission. The tokens are destroyed rather than paid to the project, and the cost is nonrefundable even when a report is invalid, falls outside the program's scope or duplicates an earlier finding. Reports submitted without a burn are not eligible for rewards.
The change follows a $1 million audit competition that ran from April 9 to May 9 and generated 809 reports from 162 researchers. Those submissions produced 127 unique security findings, excluding non-exploitable observations, and nearly half of the valid submissions duplicated earlier reports.
Jump Crypto built Firedancer as an alternative to Agave, the main software used by the computers that check and process Solana transactions. Serious flaws in that software could halt payment processing or cause validators to disagree about account balances, disrupting trades and transfers.
Why the terms changed
Jump believes AI agents helped discover or write nearly every submission in the competition. Reviewing them remained labor-intensive: engineers had to reproduce each reported problem and check whether the proposed attacks would actually work, and some submissions flagged apparent weaknesses while missing protections elsewhere in the software.
"AI has made finding bugs cheap, but judging them is still expensive," Jump's Ishan Bhatt wrote in an Oct. 16 review.
The review backlog peaked at 299 open reports. As reviews slowed, other researchers rediscovered bugs that had already been submitted but remained unfixed or undisclosed, with about 80% of duplicates arriving more than three days after the original report.
The competition had already charged $100 per submission and limited researchers to one report a day. Jump said charging discourages researchers from filing large numbers of speculative findings and leaving its engineers to validate them. The new platform also limits each main report section to 3,000 characters.
What the contest found
Despite the volume of duplicate and unworkable reports, the competition surfaced serious vulnerabilities. One was a scheduling error that could cause Firedancer to execute transactions in the wrong order and disagree with other Solana validators about the resulting network state.
Rewards temporarily increased
Alongside the submission cost, Jump is raising payouts. Eligible findings receive twice the standard reward through Nov. 20, or three times the standard amount for bugs specific to Alpenglow, Solana's new voting system. Critical Alpenglow findings can qualify for up to $300,000.
