Firedancer Requires 1 SOL Burn for Bug Bounty Eligibility

Firedancer, Jump Crypto’s independent validator software for Solana, began requiring researchers to burn 1 SOL to qualify for a bug bounty under terms that took effect Oct. 18. The requirement applies when another researcher has already submitted the same vulnerability.

The SOL must be sent to an incinerator wallet. Jump Crypto does not receive it as fee revenue. Researchers also lose the burned SOL for invalid or out-of-scope reports. Reports without the required burn may be reviewed, but cannot receive a bounty under the terms.

Firedancer generally pays the first researcher to report an issue or a similar variant. A later researcher may receive a discretionary reward for showing greater impact, a wider affected area or flaws in the original report. The terms also allow later findings to replace an earlier report when the first submission is incomplete or based on incorrect assumptions.

The current rules differ from Firedancer’s audit contest, which ran from April 9 to May 9, 2026. That contest charged $100 per report and allowed duplicate reports of an unfixed bug to qualify for rewards. Reports submitted after a fix was publicly disclosed were ineligible, while earlier reports remained eligible.

In an Oct. 16 retrospective for Jump Crypto, Ishan Bhatt reported that the contest received 809 submissions from 162 researchers. The submissions included 127 distinct security reports outside the contest’s insight category. Nearly half of the broader pool of valid submissions were duplicates.

Bhatt reported an average of about 26 submissions per day and a peak backlog of 299 open reports. About 80% of duplicate submissions arrived more than three days after the primary report. He linked part of the duplicate volume to review delays, which left vulnerabilities open for other researchers to find and report.

The current bounty terms require a reproducible, end-to-end attack against the permitted branch and configuration, with practical impact, subject to stated exceptions. The submission form has separate fields for the vulnerability description, reproduction steps, impact and proof of concept, plus a shorter summary.

Public repository material, including code comments, pull requests and mitigating changes on public branches, counts as known information. Privately known issues that can be shown to predate a report are reviewed case by case. Firedancer’s terms call for initial contact through a GitHub Security Advisory within 96 hours after the report and burn are confirmed.

Firedancer is temporarily increasing bounty payments. Eligible findings receive twice the standard reward through Nov. 20, 2026. Findings involving Alpenglow consensus receive three times the standard reward. Findings affecting only pre-Alpenglow consensus qualify for substantially reduced discretionary payments.

The Oct. 14 v26.10.2 release enabled Alpenglow support in the default testnet and devnet configurations. The payment increases end Nov. 20, while the bounty program continues after that date.