Solana’s Firedancer team has introduced a mandatory 1 SOL burn for each bug report after a monthlong security contest attracted 809 submissions, many of which were believed to have been generated or written with artificial intelligence.
The new requirement, worth roughly $100 per submission, aims to reduce spam and allow engineers to concentrate on legitimate security vulnerabilities rather than spending time reviewing low-quality reports.
Under the updated rules announced Monday, the fee cannot be refunded, even when a report is invalid, falls outside the program’s scope, or repeats a previously identified issue. Submissions that do not include the required token burn will not qualify for bounty payments.
Firedancer was developed by trading firm Jump Crypto as an alternative to Agave, the main software client used by Solana validators to process transactions and maintain the network.
Software vulnerabilities can prevent validators from processing transactions correctly or cause them to disagree over account balances and the network’s state. An excessive number of duplicate or unexploitable reports can slow security reviews and delay the resolution of genuine flaws.
AI-Assisted Submissions Overwhelm Security Reviewers
The change follows a $1 million audit competition held from April 9 through May 9. The event received 809 reports from 162 researchers and identified 127 distinct security findings after excluding observations that could not be exploited. Nearly half of the valid submissions duplicated existing reports.
Jump suspects AI agents helped discover or draft almost every submission.
“AI has made finding bugs cheap, but judging them is still expensive,” Jump’s Ishan Bhatt wrote in an Oct. 16 review.
Although AI can accelerate vulnerability discovery and report writing, engineers must still reproduce each issue and determine whether a proposed exploit is practical. Some submissions highlighted apparent weaknesses without recognizing protections elsewhere in the software.
The review queue grew to 299 outstanding reports at its peak. Delays also allowed researchers to submit vulnerabilities that had already been reported but remained under review or had not yet been disclosed. Around 80% of duplicate reports arrived more than three days after the original submission.
Before introducing the new rules, the competition already charged $100 per report and restricted participants to one submission daily. Jump said the financial requirement was intended to discourage researchers from submitting large numbers of speculative claims that engineers would then have to investigate.
The platform has also introduced a 3,000-character limit for each main section of a report to encourage more concise submissions.
Solana Security Program Increases Bounty Payments
Despite the reporting challenges, the contest uncovered significant vulnerabilities, including a scheduling flaw that could cause Firedancer to execute transactions out of sequence.
Such an error could make Firedancer validators disagree with other Solana validators about the resulting network state, potentially affecting the network’s ability to process transactions consistently.
Jump is increasing bounty payouts alongside the new submission requirement to continue attracting valuable security research.
Qualifying vulnerabilities will receive twice the standard reward through Nov. 20. Findings involving bugs specific to Alpenglow, Solana’s new voting system, will qualify for three times the usual payout.
Critical vulnerabilities affecting Alpenglow could earn researchers up to $300,000.
The revised rules highlight a growing challenge for security programs as AI tools become more capable: generating potential bug reports is becoming easier, but validating their accuracy and determining whether they represent genuine threats remains a resource-intensive process.
