Solana’s Firedancer team has introduced a new policy requiring bug reporters to pay 1 SOL (approximately $100) per submission. The move aims to curb the influx of spam reports generated by AI tools, which have overwhelmed security teams. The fee is non-refundable, even if the report is invalid, out of scope, or duplicate. Additionally, the submitted SOL must be destroyed, permanently removing it from circulation.
The policy change comes after a recent bug bounty competition held from April 9 to May 9, which attracted 162 researchers submitting 809 reports. Of these, only 127 were unique security findings, with nearly half being duplicate reports. Jump Crypto, the developer behind Firedancer, noted that almost all submissions were assisted by AI agents. “Artificial intelligence makes finding bugs cheap, but judging bugs remains expensive,” wrote Ishan Bhatt from Jump Crypto in a review on October 16.
The backlog of unprocessed reports peaked at 299, slowing down reviews and leading to repeated discoveries of unpatched vulnerabilities. To mitigate this, the new platform limits each report section to 3,000 characters and imposes a $100 fee per submission, capping daily submissions to one per researcher. The competition also uncovered critical vulnerabilities, including a scheduling error that could cause Firedancer to execute transactions out of order, potentially disrupting network consensus.
Jump Crypto is also increasing reward amounts for eligible bug reports. Until November 20, qualifying submissions will receive double the standard reward, while specific vulnerabilities in Solana’s new voting system, Alpenglow, could earn up to three times the usual payout, with a maximum reward of $300,000.