Solana bug reports now cost 1 SOL as AI floods security teams with spam

A flood of AI-assisted bug reports has prompted the team behind Solana’s Firedancer software to charge researchers 1 SOL, worth about $100, per submission, aiming to cut spam and give engineers more time to investigate genuine security flaws.

The tokens must be burned, which permanently removes them from circulation. Under terms updated Monday, the cost is nonrefundable even if a report is invalid, outside the program’s scope or duplicates an earlier finding. Reports submitted without a burn are ineligible for rewards.

Trading firm Jump Crypto built Firedancer as an alternative to Agave, the main software used by the computers that check and process Solana transactions.

A serious flaw can stop those computers processing payments or make them disagree about account balances, disrupting trades and transfers. Hundreds of duplicate or unworkable reports take engineers’ time away from investigating and fixing those vulnerabilities.

Why the new terms

A $1 million audit competition held between April 9 and May 9 attracted 809 reports from 162 researchers. Those produced 127 unique security findings, excluding non-exploitable observations. Nearly half of valid submissions were duplicates.

Jump believes AI agents helped discover or write nearly every submission.

“AI has made finding bugs cheap, but judging them is still expensive,” Jump’s Ishan Bhatt wrote in an Oct. 16 review.

Engineers still had to reproduce reported problems and check whether the proposed attacks could work. Some submissions flagged apparent weaknesses while missing protections elsewhere in the software.

The backlog peaked at 299 open reports. As reviews slowed, other researchers rediscovered bugs that had already been submitted but remained unfixed or undisclosed. About 80% of duplicates arrived more than three days after the original report.

The competition had already charged $100 per submission and limited researchers to one report a day. Jump says charging discourages researchers from submitting large numbers of speculative findings and leaving its engineers to validate them.

Its new platform also limits each main report section to 3,000 characters.

The competition uncovered serious vulnerabilities, including a scheduling error that could make Firedancer execute transactions in the wrong order and disagree with other Solana validators about the resulting network state.

Meanwhile, Jump is increasing rewards alongside the submission cost. Eligible findings receive twice the standard payout through Nov. 20, or three times for bugs specific to Alpenglow, Solana’s new voting system. Critical Alpenglow findings can qualify for up to $300,000.