Firedancer, Bounce Crypto’s unbiased validator software program for Solana, requires researchers to burn 1 SOL to qualify for a bug bounty underneath phrases efficient Oct. 18. The burn is non-refundable even when a report identifies an actual vulnerability that another person submitted first.
The change narrows the path to cost for later finders in contrast with Firedancer’s spring audit contest. In an Oct. 16 retrospective for Bounce Crypto, Ishan Bhatt partly attributes the duplicate-report drawback to the staff’s personal overview delays: researchers saved discovering bugs whereas earlier reviews waited for motion.
The present phrases usually award the primary submission about the identical problem or an identical variant, whereas preserving discretionary rewards for some later reviews.
An actual bug can nonetheless go away its finder out of pocket
Firedancer’s earlier Immunefi contest ran April 9–Could 9, 2026. Its revealed guidelines explicitly made duplicate reviews of an unfixed bug eligible for rewards. As soon as a repair was publicly disclosed, new reviews turned invalid, whereas reviews submitted earlier than the repair remained eligible.
That was already a paid submission system. In his Oct. 16 Hardening Firedancer retrospective, Bhatt says the competition charged $100 per report and imposed a restrict of 1 submission per researcher a day. The October improvement is a distinct payment construction paired with narrower duplicate eligibility.
| Rule | April–Could contest | Present Firedancer bounty |
|---|---|---|
| Submission value | $100 per report, in line with Bhatt | Non-refundable 1 SOL burn for bounty eligibility |
| Duplicate eligibility | Unfixed duplicates eligible earlier than public disclosure of a repair | First submission usually receives the reward; later-report exceptions stay discretionary |
| Researcher publicity | A qualifying later report may share in contest rewards | The burn stays a price even when a reproduction earns no reward |
A later researcher might earn a reward by demonstrating larger impression or a wider affected floor. An incomplete first submission, or one resting on incorrect assumptions, might permit a later report back to change into the chief discovering. The staff also can reward high-quality later work.
Eligibility additionally extends past duplicate standing. The phrases deal with related public repository materials, together with code feedback, pull requests and mitigating adjustments on public branches, as recognized points. Privately recognized points that demonstrably predate a report obtain case-by-case consideration. The baseline proof-of-concept necessities name for a reproducible end-to-end assault towards the allowed department and configuration, displaying sensible impression, topic to specified discretionary exceptions.
The submission type describes an irreversible switch to an incinerator pockets. The phrases additionally make the burn non-refundable for invalid and out-of-scope reviews. This can be a value burned by the researcher; Bounce doesn’t acquire it as payment income. Reviews with out a burn might or will not be reviewed, however can not obtain a bounty underneath the phrases.
Firedancer is conserving rewards obtainable and briefly growing them. Eligible findings obtain twice the usual payout by means of Nov. 20, 2026, or 3 times the usual payout for Alpenglow consensus findings. Findings affecting solely pre-Alpenglow consensus obtain drastically diminished discretionary rewards. The deadline ends the increase, slightly than the bounty itself.
The Oct. 14 v26.10.2 launch consists of Alpenglow assist enabled in default testnet and devnet configurations.
The duplicate queue had a overview drawback
Bhatt’s account of the spring contest explains why the cost change reaches past spam deterrence.
He reviews 809 whole submissions from 162 researchers, leading to 127 distinctive safety submissions outdoors the competition’s perception class. Practically half of legitimate submissions have been duplicates. The 127 determine counts distinct non-insight submissions; the duplicate share refers back to the broader pool of legitimate submissions.
His extra revealing figures concern the queue. At roughly 26 submissions a day, the backlog peaked at 299 open reviews. Round 80% of duplicate submissions arrived greater than three days after the first report, he says.
Bhatt describes a suggestions loop. Earlier findings remained unfixed or undisclosed whereas overview lagged, leaving different researchers to find and submit the identical issues. These reviews added extra overview work. Duplicate submissions declined because the staff’s triage caught up, in line with his account.
Bhatt additionally says the staff believes practically each contest report was found or written by an agent. He suggests researchers utilizing related fashions converged on the identical bugs.
mycryptopot reported an identical filing-risk problem in August throughout Anza’s separate Alpenglow competitors, which required a 0.5 SOL burn per report. Firedancer’s retrospective provides a selected operational lesson: its personal overview backlog helped maintain alternatives for repeated discovery open.
In his Jan. 26 account of curl’s bounty closure, Daniel Stenberg rejected charging researchers at that time partly due to administrative friction and the chance of deterring professional reporters. He introduced the bounty would cease Jan. 31 whereas non-public safety reporting continued.
The helpful check is what reaches a repair
Bhatt’s retrospective describes a high-severity scheduling discovering that might make Firedancer execute transactions in a distinct order and diverge from different validator shoppers.
Firedancer has modified components of that course of. Bhatt says the staff is documenting system invariants extra explicitly for automated auditors. The stay type permits 3,000 characters every for the vulnerability description, copy steps, impression and proof of idea, with a 1,024-character abstract. Clearer assumptions will help researchers assess a suspected bug; concise copy directions will help reviewers act on it.
The present phrases additionally inform researchers to count on contact by means of a GitHub Safety Advisory inside 96 hours after submission and affirmation of the required burn. That expectation covers preliminary contact. It provides no deadline for validating the assault, making ready a patch or deploying a repair.
