The team behind Firedancer, Solana's independent validator client built by Jump Crypto, implemented a new bug bounty policy on October 18, 2026, requiring researchers to burn 1 SOL with every submission. The burned tokens are permanently removed from circulation and do not go to Jump Crypto or any other party.
The policy applies to all reports without exception, including duplicates and resubmissions of already-reported issues. Researchers who do not burn SOL can still have their reports reviewed, but become ineligible for any payout.
Motivation and Recent History
Jump Crypto previously ran a public audit contest from April 9 to May 9, 2026, which drew 809 submissions from 162 researchers. Only 127 turned out to be unique security findings, with nearly half the reports identified as duplicates. The review backlog peaked at 299 open reports during the contest.
The team attributed many of the duplicate and low-quality submissions to AI-assisted or AI-generated reports. The cost of generating plausible-sounding vulnerability descriptions at scale has created an incentive for high-volume submissions, with reviewers bearing the burden of sorting legitimate findings from noise.
Revised Reward Structure
Alongside the submission fee, Jump Crypto introduced enhanced payouts through November 20, 2026. Standard bug bounty rewards are doubled during this period. Reports related to Alpenglow, Solana's new consensus system that went live on mainnet October 21, 2026, receive triple the standard amounts. Critical flaws in Alpenglow's voting system can reach $300,000, at the team's discretion.
Significance for Solana
Firedancer is one of multiple independent validator clients for Solana. Running separate implementations of validator software reduces systemic risk by ensuring that a single bug cannot compromise the entire network. The quality of Firedancer's security review process directly affects Solana's overall resilience.
Broader Implications
For security researchers, the change creates financial barriers for low-effort submissions while offering substantial rewards for genuine critical findings. Honest researchers who discover already-reported issues still pay the submission fee, adding a layer of risk when working on well-scrutinized code areas.
The burn mechanism is technically deflationary for SOL supply, though bug report volume is unlikely to meaningfully impact total circulation. The policy presents a potential model for other crypto projects managing open bounty programs and AI-generated spam.
The approach carries trade-offs: a paywall may discourage newer or less-funded researchers from participating, while potentially incentivizing some researchers to withhold vulnerability reports. The scheduled end of enhanced payouts on November 20, 2026, will provide a benchmark for assessing whether the submission fee effectively reduces spam.
