Jump Crypto has made a 1 SOL burn mandatory for every vulnerability submission to Firedancer, its independent validator client for Solana. The fee is permanently destroyed, cannot be refunded and is required even when a report is invalid, outside the program’s scope or a duplicate. Reports submitted without the burn may be reviewed, but they cannot qualify for a bounty.
The change follows a monthlong Firedancer audit competition that ran from April 9 to May 9 and attracted 809 reports from 162 researchers. After insight-level submissions were excluded, the contest produced 127 unique security findings, while nearly half of valid reports duplicated issues already submitted. Jump said the contest generated roughly 20 times the report volume of its earlier Frankendancer competition, which lasted two weeks longer.
Jump said it believed nearly every submission had been discovered or written with help from an AI agent. The company described a split in the results: automated tools were effective at spotting differences between Firedancer and Solana’s Agave validator client or violations of clearly documented rules, but many reports produced false positives because they missed implicit assumptions about how Solana’s components interact. The contest reached a backlog of 299 open reports at its peak, and Jump said about 80% of duplicate submissions arrived more than three days after the initial report.
The competition nevertheless identified serious flaws. One high-severity scheduling bug could cause Firedancer to execute transactions in the wrong order, producing a different result from other validators and creating a consensus divergence.
Alongside the submission charge, the new bounty program is doubling standard rewards through Nov. 20 and tripling payouts for findings related to Alpenglow, Solana’s new consensus system. Under the published ranges, a critical Alpenglow finding can qualify for as much as $300,000, although final awards remain discretionary. Researchers must provide reproducible proof-of-concept material, complete identity checks before payment and avoid public disclosure or testing on public clusters before a fix is deployed.