Solana Bug Bounty: Firedancer Charges 1 SOL as AI-Generated Reports Surge

Jump Crypto has introduced a nonrefundable 1 SOL submission requirement for security researchers reporting vulnerabilities in Firedancer, its alternative software client for the Solana blockchain. The change aims to reduce a surge of AI-assisted reports that overwhelmed engineers with duplicate findings and unworkable claims. At the time of the announcement, 1 SOL was valued at roughly $100, although the dollar cost fluctuates with the token’s market price. The new policy took effect under terms updated October 26, while rewards for qualifying vulnerabilities have also increased.

AI Flood Overwhelms Security Reviews

Firedancer is designed to provide an independent alternative to Agave, Solana’s established validator client. Validators run this software to process transactions and agree on the blockchain’s state. A serious flaw could disrupt transaction processing or cause different validators to reach conflicting results, potentially threatening network reliability.

Jump Crypto’s October 16 security review described the scale of the problem. A $1 million audit competition, held from April 9 to May 9, attracted 809 submissions from 162 researchers. The team identified 127 unique, non-informational security findings, while nearly half of valid submissions were duplicates.

The review queue reached 299 open reports, with roughly 26 submissions arriving daily. About 80% of duplicate reports came more than three days after the original finding, as delays allowed other researchers and AI agents to rediscover issues that had not yet been resolved or disclosed. Jump said AI tools helped generate or identify nearly every submission.

As Ishan Bhatt of Jump Crypto explained in the review, finding bugs has become cheaper with AI, but evaluating whether those findings are genuine remains expensive. Engineers still need to reproduce each issue, test its impact and distinguish exploitable vulnerabilities from false alarms.

Why Firedancer Charges 1 SOL

Under the revised Firedancer bounty terms, researchers must burn 1 SOL with each report. Burning sends the tokens to an incinerator address, permanently removing them from circulation rather than generating fee revenue for Jump. The payment is nonrefundable, including when a report is invalid, out of scope or a duplicate. Reports without the required burn are not eligible for rewards.

The platform also limits each main report section to 3,000 characters, encouraging researchers to provide concise descriptions and reproducible evidence instead of lengthy, AI-generated explanations.

The new rules follow an earlier competition that already charged $100 per submission and restricted participants to one report daily. Jump concluded that additional barriers were necessary to discourage high-volume submissions with little security value.

Rewards Rise for Critical Vulnerabilities

Jump is pairing the submission cost with higher payouts through November 20, 2026. Eligible findings receive twice the standard reward, while vulnerabilities specific to Alpenglow, Solana’s planned consensus upgrade, qualify for three times the standard payout.

Key terms include:

• Critical Alpenglow bugs: Up to $300,000 under the boosted schedule.
• High-severity findings: Up to $150,000 for qualifying Alpenglow issues.
• Submission requirement: An irreversible 1 SOL burn for every report.
• Review process: Reports must demonstrate a distinct vulnerability with clear reproduction steps.

The contest also uncovered a high-severity transaction-scheduling flaw that could cause Firedancer to execute transactions in the wrong order, creating disagreement between validators.

Conclusion

Firedancer’s new fee reflects a broader security challenge: AI can accelerate vulnerability discovery, but it can also multiply the cost of reviewing weak or repeated claims. Jump is betting that a financial barrier, shorter reports and higher rewards for serious findings will help engineers focus on flaws that pose genuine risks to Solana.