Jump Crypto raises Firedancer bug bounty submission costs on Solana

Traders Union
All News
Crypto
Jump Crypto ups bug bounty rules

Highlights

Jump Crypto now requires researchers to permanently burn 1 SOL per vulnerability submission for the Firedancer bug bounty, reducing speculative reports and ineligible entries.
Jump's $1 million competition (April 9–May 9) yielded 809 reports from 162 researchers, with nearly 50% of valid submissions being duplicates, likely aided by AI.
Through Nov. 20, eligible valid bug reports receive double payouts, Alpenglow-specific bugs triple, and critical Alpenglow vulnerabilities can earn up to $300,000.

Submission fee targets review backlog

As reported by CoinDesk, citing Jump Crypto, researchers submitting vulnerabilities to the Firedancer bug bounty program must now permanently burn 1 SOL per report, and submissions without that burn are not eligible for rewards.

The updated terms say the fee is nonrefundable even when a report is invalid, falls outside the program's scope or duplicates an earlier finding. Jump says the change is meant to reduce speculative submissions that consume engineering time needed to assess genuine security issues.

Firedancer is the alternative Solana validator client built by Jump Crypto to compete with Agave, the main software used by computers that verify and process Solana transactions. Serious flaws in that software can halt payment processing or cause validators to disagree over account balances, creating disruption for trades and transfers.

A $1 million audit competition that ran from April 9 to May 9 drew 809 reports from 162 researchers and produced 127 unique security findings, excluding non-exploitable observations. Nearly half of valid submissions were duplicates, and Jump says AI agents likely helped discover or write nearly every submission.

In an Oct. 16 review, Jump's Ishan Bhatt wrote that AI has made bug discovery cheap while judgment remains expensive. Engineers still need to reproduce reported issues and test whether proposed attack paths can actually work, including cases where a submission points to an apparent weakness but misses safeguards elsewhere in the code.

Higher rewards accompany stricter rules

The review backlog peaked at 299 open reports, and slower triage appears to have contributed to more duplicate filings as other researchers rediscovered bugs that had already been submitted but were not yet fixed or disclosed. About 80% of duplicate reports arrived more than three days after the original submission.

Jump is also imposing a 3,000-character limit on each main report section under its new platform. The company says the earlier contest still uncovered serious vulnerabilities, including a scheduling flaw that could cause Firedancer to execute transactions in the wrong order and diverge from other Solana validators on the resulting network state.

At the same time, Jump is raising incentives for valid submissions. Eligible findings receive double the standard payout through Nov. 20, while bugs specific to Alpenglow, Solana's new voting system, qualify for triple payouts, and critical Alpenglow vulnerabilities can earn as much as $300,000.

Our earlier article on a KPMG U.S. CEO survey showed that many large companies are already seeing efficiency or growth gains from AI agents, even though only a small share view them as truly transformational so far. It also highlighted that firms expect continued hiring, retraining and heavy investment in AI infrastructure as they work through the harder task of integrating agentic systems into core workflows.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.