Solana’s Firedancer security program now requires researchers to burn 1 SOL, worth approximately $100, for every bug report submitted. The policy follows a monthlong audit competition that received 809 reports, with AI tools suspected of helping generate or draft nearly all of them.
Jump Crypto, the company developing Firedancer, introduced the fee to reduce spam and prevent engineers from being overwhelmed by duplicate or unusable submissions. The new rules, updated Monday, make the payment nonrefundable regardless of whether a report is valid, eligible for the program, or repeats a previously identified vulnerability. Submissions without the required token burn will not receive rewards.
Firedancer is an alternative Solana validator client designed to work alongside Agave, the network’s primary client. Vulnerabilities in either implementation can disrupt transaction processing or cause validators to disagree about account balances and the network’s state.
When security teams must review hundreds of weak or repetitive reports, their ability to investigate genuine threats can suffer.
AI-Driven Reports Increase the Burden on Security Teams
The policy change follows a $1 million audit competition held from April 9 to May 9. The event attracted 162 researchers who submitted 809 reports, resulting in 127 unique security findings after non-exploitable observations were excluded. Nearly half of the valid submissions were duplicates.
Jump believes AI agents contributed to discovering or writing almost every report.
In an Oct. 16 review, Jump’s Ishan Bhatt wrote, “AI has made finding bugs cheap, but judging them is still expensive.”
Engineers still needed to reproduce the reported vulnerabilities and verify whether the suggested attacks could succeed. Some submissions identified possible weaknesses without accounting for safeguards elsewhere in the code.
The backlog reached 299 unresolved reports at its peak. As reviews fell behind, additional researchers reported vulnerabilities that had already been submitted but were still awaiting investigation or disclosure. Approximately 80% of duplicate reports arrived more than three days after the original submission.
The contest had already charged $100 per report and imposed a daily submission limit of one report per researcher. Jump said the fee was intended to discourage speculative submissions that consume engineering resources without producing useful findings.
The reporting platform now also restricts each main section of a submission to 3,000 characters.
Higher Bounties Aim to Attract Critical Findings
Despite the large volume of submissions, the contest identified serious security issues. One vulnerability involved a transaction scheduling error that could cause Firedancer to execute transactions in the wrong order, potentially leading its validators to disagree with other Solana validators about the network’s resulting state.
Jump is raising rewards to encourage researchers to continue identifying meaningful vulnerabilities despite the higher cost of submitting reports.
Eligible findings will receive double the standard payout through Nov. 20. Vulnerabilities specific to Alpenglow, Solana’s new voting system, qualify for three times the usual reward, with critical findings eligible for payments of up to $300,000.
The changes reflect a growing challenge for blockchain security teams: AI can accelerate the production of potential vulnerability reports, but confirming whether those reports identify real, exploitable weaknesses still requires substantial technical work.
