Firedancer, the independent validator software for Solana developed by Jump Crypto, has introduced stricter terms for its bug bounty program. Effective October 18, researchers must now burn 1 SOL to qualify for a bounty, a non-refundable fee even if their report is a duplicate of a previously submitted vulnerability. This shift narrows the path to payment for later finders compared to Firedancer's spring audit contest, where duplicate reports of unfixed bugs were eligible for rewards.
The change comes after Firedancer's earlier Immunefi contest, which ran from April 9 to May 9, 2026. During that period, duplicate reports were rewarded if the bug remained unfixed. However, the new terms prioritize the first submission, with discretionary rewards for some later reports. The burn fee is irreversible and applies even to invalid or out-of-scope reports, serving as a deterrent for spam rather than a revenue source for Jump Crypto.
In an October 16 retrospective, Ishan Bhatt of Jump Crypto attributed the duplicate-report problem to review delays. He noted that 80% of duplicate submissions arrived more than three days after the primary report, creating a feedback loop where unfixed bugs led to repeated discoveries. The team has since improved its triage process, but the new burn requirement aims to further reduce duplicate submissions.
Firedancer is also temporarily increasing bounty rewards. Eligible findings receive double the standard payout through November 20, 2026, or triple for Alpenglow consensus findings. The Oct. 14 v26.10.2 release includes Alpenglow support enabled in default testnet and devnet configurations, reflecting ongoing improvements to the software.