The team behind Firedancer, the Solana validator client developed by Jump Crypto, has introduced a mandatory fee of 1 SOL — roughly $100 — for every vulnerability report submitted to its security program. The SOL must be permanently burned, and the fee is nonrefundable even if a submission is invalid, out of scope, or duplicates an already known bug. Reports submitted without the burn are not eligible for rewards.
The policy follows a $1 million audit competition held from April 9 to May 9, which drew 809 reports from 162 researchers but produced only 127 unique security findings after excluding non-exploitable observations. According to Jump Crypto, AI tools were used to discover or write nearly all submissions. The review backlog peaked at 299 open reports, and about 80% of duplicate reports arrived more than three days after the first report of the same vulnerability.
As part of the new rules, researchers are limited to one report per day, and each main report section is capped at 3,000 characters. The audit uncovered serious issues, including a scheduling bug that could change transaction execution order and cause Solana validators to disagree on network state.
Jump is temporarily increasing payouts to encourage quality research: valid findings receive double the standard reward through November 20, and bugs specific to Alpenglow, Solana’s new voting system, qualify for triple payouts. Critical Alpenglow vulnerabilities can earn up to $300,000.
