Solana bug reports now cost 1 SOL as AI floods security teams with spam

What it is

Firedancer, the Solana validator client built by Jump Crypto, changed its bug bounty terms on Monday, 26 October 2026. Each submission now requires burning 1 SOL (about $100). The burn is nonrefundable, even if the report is invalid, out of scope or a duplicate. A report submitted without a burn is ineligible for rewards. Jump says AI agents helped find or write nearly every submission in its April to May 2026 audit contest.

Why the terms changed

Jump's Ishan Bhatt wrote in an Oct. 16 review: "AI has made finding bugs cheap, but judging them is still expensive." Engineers had to reproduce each reported problem and check whether the proposed attack could work. Some reports flagged apparent weaknesses while missing protections elsewhere in the software.

The contest ran 9 April to 9 May and drew 809 reports from 162 researchers. These produced 127 unique findings, with non-exploitable observations excluded. The review backlog peaked at 299 open reports.

Slow review fed the duplicate problem. Other researchers rediscovered bugs that had been submitted but were still unfixed or undisclosed. About 80% of duplicates arrived more than three days after the original report.

The contest already charged $100 per submission and allowed one report a day. Jump says the fee discourages bulk speculative submissions. The new platform also caps each main report section at 3,000 characters.

What to do

Researchers planning to submit should note the following:

• Burn 1 SOL before each submission, or the report earns no reward.
• Keep each main section under 3,000 characters.
• Rewards are doubled through 20 November 2026. Alpenglow-specific bugs get triple the standard payout, and critical Alpenglow findings can reach $300,000.

Caveats

The page does not say whether the daily submission limit carries over to the new platform. It does not say how the burn is verified or how rewards compare with the fee for lower-severity bugs. That Jump believes AI helped with nearly every submission is the company's own assessment. One serious contest finding was a scheduling error that could make Firedancer execute transactions in the wrong order and disagree with other Solana validators about network state. The page gives no further detail on it.