Solana's Firedancer development team now requires researchers to burn 1 SOL—roughly $100—for every bug report submitted. The nonrefundable protocol, implemented Monday, is designed to choke off the influx of AI-generated or AI-assisted submissions that overwhelmed engineers during a recent audit competition.
Reports without the burn are ineligible for rewards. The burned SOL is permanently removed from circulation. Critically: the burn happens regardless of whether the report is valid, in-scope, or a duplicate.
Firedancer is Jump Crypto's alternative client software to Agave. It processes Solana transactions and verifies their integrity across the network. A critical vulnerability here could halt payment processing or cause validators to fork on account balances—a network killer.
The numbers tell the story. An April 9 to May 9 audit competition pulled 809 reports from 162 researchers. Of those, 127 were unique security findings. Nearly half of all valid submissions were duplicates. Engineers faced a backlog that peaked at 299 open reports. About 80 percent of duplicate reports arrived more than three days after the original—meaning reviewers burned cycles on issues already flagged and waiting for a fix.
Jump Crypto's Ishan Bhatt nailed the problem in an Oct. 16 review: "AI has made finding bugs cheap, but judging them is still expensive."
The competition already charged $100 per submission and capped researchers at one report daily. Those guardrails didn't work. Engineers spent significant time reproducing reported problems, verifying attack feasibility, and filtering low-signal findings that flagged weaknesses without accounting for existing protections in the broader codebase.
The new burn requirement pairs with a 3,000-character limit per report section—forcing researchers to be surgical, not verbose.
But Jump Crypto is also raising the stakes on rewards. Eligible findings get double payout through Nov. 20. Bugs specific to Alpenglow, Solana's new voting system, command triple payout—critical Alpenglow findings can hit $300,000.
The competition did surface real vulnerabilities. One scheduling error in Firedancer could cause it to execute transactions in the wrong order, creating state divergence between Firedancer and other validators on the network.
