Firedancer Imposes 1 SOL Fee for Bug Bounty Reports
The new non-refundable cost aims to reduce spam and manage report backlogs for the Solana validator client.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you believe companies should charge researchers a fee to submit software bug reports?
Firedancer has introduced a non-refundable 1 SOL burn requirement for all security bug bounty submissions. This new policy is designed to reduce spam and manage backlogs, and it applies even to invalid or duplicate reports.
Why it matters
The change addresses significant review bottlenecks that previously allowed researchers to flood the system with redundant findings. By imposing a financial cost, the project aims to ensure that only high-quality, actionable reports reach its security team.
The new submission protocol requires a 1 SOL transaction to a dead-end incinerator wallet for every entry. Researchers must fit descriptions and reproduction steps within a 3,000-character limit, and the system now mandates a 96-hour turnaround for initial contact.
The players
Firedancer
A high-performance validator client designed to improve the scalability and throughput of the Solana blockchain network.
Jump Crypto
The digital asset division of Jump Trading, responsible for the development and maintenance of the Firedancer client.
The details
Researchers submit findings through an automated form that triggers an irreversible transaction to a wallet that cannot be accessed. This mechanism forces a barrier to entry meant to deter the high volume of low-quality or repeat submissions seen in previous contests, such as the spring session that saw 809 reports from 162 researchers. The policy is paired with increased payouts, offering double the standard bounty and triple for Alpenglow consensus findings to maintain incentive for serious contributors.
Timeline
Oct. 18, 2026: New bug bounty terms became effective.
Nov. 20, 2026: The current period for increased bounty payouts ends.
The Tech Race
The move marks a departure from traditional, open-access bug bounty programs common in the blockchain space. It follows a spring contest where high submission volumes created a peak backlog of 299 open reports, complicating the development team's ability to maintain the Firedancer validator roadmap.
Security researchers must now hold and be prepared to spend 1 SOL for every report submitted to the Firedancer program, regardless of the report's validity. This shift prioritizes serious contributors but removes the zero-cost testing environment previously available to community hackers.
The takeaway
This policy forces a trade-off between open-source community testing and operational efficiency by commoditizing the submission process. Researchers should monitor the program for the scheduled payout reductions occurring on Nov. 20, 2026.
What happens next
Participants should track the Nov. 20, 2026, deadline, after which the current temporary increase in bounty payouts is scheduled to conclude.
Further reading
For broader trends in secure software development and threat mitigation, visit Cybersecurity.
Live Poll
Do you believe companies should charge researchers a fee to submit software bug reports?
