Anza is charging safety researchers a non-refundable 0.5 SOL to file every Alpenglow discovering earlier than the competitors closes at 16:00 UTC on Aug. 19.
The foundations require each discovering to go by way of a chosen portal, which burns the price and creates one confidential GitHub Safety Advisory. Studies despatched by way of one other channel are ineligible.
The goal is consequential. SIMD-0326 proposes Alpenglow as a backwards-incompatible substitute for Solana’s present Proof-of-Historical past and TowerBFT consensus protocol. Anza has put the brand new consensus parts, their validator integrations and the migration path contained in the bounty’s non permanent scope.
Researchers pay the submitting price earlier than Anza determines validity, severity, duplication or reward. In addition they work in opposition to a transferring model of Agave grasp. Every report should establish the commit the place the flaw appeared, reproduce the difficulty there and arrive whereas the bug stays unfixed on grasp.
A proof-of-concept requirement and the submitting burn can scale back placeholder submissions. They will additionally worth out a legitimate discovering whose impression or precedence is unsure. The revealed guidelines include no measure of participation or report high quality that will settle the tradeoff.
Researchers pay earlier than eligibility is settled
The competitors overview says Alpenglow was excluded from Agave’s standing bounty throughout growth, monorepo migration and internal-audit phases. The 2-week competitors opens an enumerated set of Alpenglow code that features the Votor voting engine, vote and certificates messages, BLS signature and certificates verification, the TowerBFT migration path and specified validator integration surfaces.
A number of boundaries stay. Public or beforehand disclosed points don’t qualify. Identified points, take a look at code, third-party cryptography dependencies and bizarre TowerBFT-only paths are additionally excluded. Researchers should reveal findings on an area fork, multi-node harness or simulation; mainnet and public-testnet assaults are unauthorized.
Solana simply absorbed a historic DDoS assault, and the silence tells buyers every part they should know
Whereas the market panicked over worth drops, the community confronted a Google-scale assault with no single second of downtime, proving the “outage meme” might lastly be useless.
Precedence is dependent upon proof, not a timestamp alone. The earliest report that meets the proof-of-concept bar at Anza’s assessed severity receives the award for that root trigger. A placeholder reserves nothing. Later duplicates obtain nothing until one substantiates a strictly greater assessed severity.
Eligibility ends when a repair reaches Agave grasp. A report can due to this fact lose its likelihood of fee through the competitors even when the researcher reproduced the flaw in opposition to an earlier in-window commit.
Beneath the Alpenglow guidelines, the marketed 50,000 SOL is the most important mixture pool, unlocked solely by the best severity:
| Highest legitimate discovering | Unlocked pool |
|---|---|
| DoS or Different | 10,000 SOL |
| Liveness or lack of availability | 20,000 SOL |
| Consensus or security violation | 30,000 SOL |
| Lack of funds | 50,000 SOL |
Particular person awards use smaller ranges. Loss-of-funds findings obtain 6,250 to 25,000 SOL, consensus or security violations 3,125 to 12,500 SOL, liveness findings 1,250 to five,000 SOL, and DoS findings 315 to 1,250 SOL.
Anza reduces awards proportionally if the mixed awards exceed the unlocked pool. Fewer or smaller findings can go away a part of the pool unpaid. Even a loss-of-funds end result unlocks the price range with out elevating any single award above 25,000 SOL.
Fee comes after the Sept. 2 adjudication shut and KYC. Awards are lump sums in SOL locked for 12 months beneath the standing Agave bounty phrases. The submitting burn is instant; compensation is dependent upon later adjudication and stays illiquid for a 12 months.
The Alpenglow bounty covers a consensus migration
Alpenglow’s Votor parts use BLS-based vote and certificates aggregation and verification. Notarization, skip, finalization, and notar-fallback certificates require 60% of stake, whereas quick finalization requires 80%. The preliminary design retains Turbine for information dissemination.
The proposal defines a 20+20 safety mannequin with 40% crash-failure resilience. It labels implementation danger as the primary disadvantage, calls migration difficult, and states that the brand new voting logic is incompatible with its predecessor.
Anza included each core consensus crates and validator code that processes certificates, rewards and finalization state. The TowerBFT handoff is eligible too, placing the joins between outdated and new logic beneath assessment alongside Votor itself.
The official guidelines and overview nonetheless listed Aug. 19 because the cutoff when checked on Aug. 18, with no extension discover on both web page. The submission window’s shut doesn’t activate Alpenglow or full the migration.
Confidentiality additionally separates the deadline from any public end result. A discovering stays non-public till its repair ships. Code awaiting mainnet activation can stay beneath embargo till the repair is merged and the related function gate prompts.
An empty public report after Aug. 19 would reveal nothing in regards to the variety of advisories. Earlier than adjudication, the disclosed economics inform the story: 0.5 SOL leaves a researcher’s pockets first, proof determines precedence, and solely a substantiated loss-of-funds flaw opens the total pool.
