Firedancer implements 1 SOL burn requirement for bug bounty program

Firedancer, the independent validator software for Solana developed by Jump Crypto, has introduced new rules for its bug bounty program effective October 18, 2026. Under the new terms, researchers are required to burn 1 SOL to qualify for the program. This burn is non-refundable, even if the researcher identifies a legitimate vulnerability that had been previously reported by another party.

The new structure marks a shift from the previous Immunefi contest held between April 9 and May 9, 2026, which allowed for rewards on duplicate reports of unfixed bugs. In the current system, rewards are generally reserved for the first submission of a specific issue, though the team retains discretion to reward later reports under certain circumstances.

Retrospective analysis suggests the move addresses a high volume of duplicate reports. During the spring contest, approximately half of the 809 submissions were duplicates, often arriving within three days of an initial report. This influx was partly attributed to delays in the review process.

Additionally, Firedancer has adjusted its reward tiers. Rewards for findings affecting the Alpenglow consensus have tripled, while rewards for findings affecting previous consensus mechanisms have been significantly reduced. Researchers can expect an initial response via GitHub Security Advisory within 96 hours of submission.