Solana’s Firedancer team is requiring researchers to permanently burn 1 SOL, worth roughly $100, for every vulnerability submission starting Monday, a response to an audit competition that drew 809 reports but produced only 127 unique security findings.
The monthlong competition, which ran from April 9 through May 9, 2026, attracted 162 researchers but revealed a severe spam problem. Nearly half of all valid submissions were duplicates, with 80% of those arriving more than three days after the original report. At its peak, the backlog of open reports reached 299.
Jump Crypto, the trading firm that built Firedancer, attributes the flood to AI-assisted submission generation. “AI has made finding bugs cheap, but judging them is still expensive,” Ishan Bhatt of Jump Crypto wrote in an Oct. 16 review of the competition results.
Firedancer is an alternative to Agave, the primary software that powers Solana validator nodes responsible for checking and processing transactions. A critical vulnerability in transaction-processing software can halt payment processing or cause validators to disagree on account balances, disrupting trades and transfers on the network.
The competition already charged $100 per submission and limited researchers to one report daily. The new 1 SOL permanent burn requirement adds a financial friction layer designed to discourage low-effort, AI-generated submissions without blocking legitimate researchers.
Despite the noise, the audit uncovered serious flaws. One vulnerability involved a scheduling error that could cause Firedancer to execute transactions in the wrong order and disagree with other Solana validators about network state.
Jump Crypto is increasing payouts through Nov. 20 to offset the higher submission cost. Standard bug bounties will receive double the usual reward, while critical findings related to Alpenglow, Solana’s new voting system, are eligible for up to $300,000. Alpenglow-specific bugs qualify for a three-times multiplier on top of the doubled payout period.
The competition’s $1 million prize pool distributed funds across all valid submissions, but the duplicate problem meant many researchers pursued the same vulnerabilities independently. The new burn mechanism aims to ensure that only researchers confident in their findings will submit reports.
