Firedancer has introduced a non-refundable 1 SOL cost for researchers submitting vulnerabilities to its bug bounty program, adding a financial filter to the disclosure process for Solana’s alternative validator client. Under the official terms effective October 26, every bounty-eligible submission must be accompanied by exactly 1 SOL permanently sent to the Solana incinerator address, including reports ultimately classified as duplicates, invalid or outside the program’s scope.
The team says the burn requirement is intended to prevent spam and improve the quality of incoming reports. A submission made without burning SOL may still be reviewed at Firedancer’s discretion, but it cannot qualify for a bounty payment. The submission interface itself normally unlocks after detecting a matching burn transaction, tying each eligible report to an irreversible on-chain cost.
Higher Rewards Offset a New Submission Cost
The new requirement arrives alongside a temporary increase in bounty payouts through November 20. Eligible vulnerabilities currently receive twice the standard reward, while findings specifically related to Alpenglow receive three times the normal range. A critical vulnerability ordinarily carries a guideline payout of $50,000 to $100,000, rising to $100,000-$200,000 under the general promotion or $150,000-$300,000 for qualifying Alpenglow issues.
Firedancer retains broad discretion over whether a report qualifies and how much it earns. Severity, exploit practicality, novelty, report quality and systemic impact all influence payouts, while incorrectly overstating severity can result in reclassification or loss of eligibility. The 1 SOL burn therefore buys no guarantee of compensation, even when a researcher submits a technically genuine issue.
Duplicate handling adds another element of risk for researchers. Normally, the earliest qualifying submission receives the reward, although later reports can still qualify when they demonstrate greater impact, broader attack surface or materially better evidence. Researchers can consequently lose the submission fee even when another person independently reports the same vulnerability first.
Alpenglow Shapes the Current Security Scope
The bounty’s current scope reflects Firedancer’s transition toward Solana’s new consensus architecture. Only configurations running Alpenglow are permitted, while Tower BFT findings are excluded. That focus follows Solana’s earlier Alpenglow validator testing, which moved the consensus redesign into environments where client correctness and validator behavior could be tested under increasingly realistic conditions.
Firedancer is particularly important because Solana has historically depended heavily on a dominant validator implementation. Broader Solana infrastructure development has therefore placed client diversity alongside throughput and finality as a network-resilience issue. A security defect affecting an independent validator client can have consequences beyond one operator if that implementation eventually controls a meaningful share of network stake.
The program nevertheless excludes vulnerabilities that belong to the Solana protocol itself rather than Firedancer’s implementation. Protocol-level bugs must be reported through the Agave bounty, while findings involving Firedancer’s own reachable validator code remain eligible under specified configurations. The distinction separates client implementation failures from flaws inherent to network rules shared across multiple clients.
Firedancer’s terms also require successful researchers to complete KYC before receiving USDC payouts and prohibit public disclosure before a fix reaches public clusters. The revised model effectively trades unrestricted free submissions for a paid filtering mechanism paired with temporarily larger rewards, making November 20 the immediate cutoff for the current 2x and 3x incentive structure.