Firedancer, Soar Crypto’s unbiased validator software program for Solana, requires researchers to burn 1 SOL to qualify for a bug bounty below phrases efficient Oct. 18. The burn is non-refundable even when a report identifies an actual vulnerability that another person submitted first.
The change narrows the path to fee for later finders in contrast with Firedancer’s spring audit contest. In an Oct. 16 retrospective for Soar Crypto, Ishan Bhatt partly attributes the duplicate-report drawback to the workforce’s personal evaluate delays: researchers stored discovering bugs whereas earlier reviews waited for motion.
The present phrases usually award the primary submission about the identical problem or an identical variant, whereas preserving discretionary rewards for some later reviews.
An actual bug can nonetheless go away its finder out of pocket
Firedancer’s earlier Immunefi contest ran April 9–Could 9, 2026. Its revealed guidelines explicitly made duplicate reviews of an unfixed bug eligible for rewards. As soon as a repair was publicly disclosed, new reviews turned invalid, whereas reviews submitted earlier than the repair remained eligible.
That was already a paid submission system. In his Oct. 16 Hardening Firedancer retrospective, Bhatt says the competition charged $100 per report and imposed a restrict of 1 submission per researcher a day. The October growth is a distinct price construction paired with narrower duplicate eligibility.
RuleApril–Could contestCurrent Firedancer bountySubmission value$100 per report, in keeping with BhattNon-refundable 1 SOL burn for bounty eligibilityDuplicate eligibilityUnfixed duplicates eligible earlier than public disclosure of a fixFirst submission usually receives the reward; later-report exceptions stay discretionaryResearcher exposureA qualifying later report may share in contest rewardsThe burn stays a price even when a replica earns no reward
A later researcher could earn a reward by demonstrating larger influence or a wider affected floor. An incomplete first submission, or one resting on incorrect assumptions, could permit a later report back to grow to be the chief discovering. The workforce may also reward high-quality later work.
Eligibility additionally extends past duplicate standing. The phrases deal with related public repository materials, together with code feedback, pull requests and mitigating modifications on public branches, as recognized points. Privately recognized points that demonstrably predate a report obtain case-by-case consideration. The baseline proof-of-concept necessities name for a reproducible end-to-end assault in opposition to the allowed department and configuration, displaying sensible influence, topic to specified discretionary exceptions.
The submission kind describes an irreversible switch to an incinerator pockets. The phrases additionally make the burn non-refundable for invalid and out-of-scope reviews. This can be a value burned by the researcher; Soar doesn’t gather it as price income. Stories and not using a burn could or is probably not reviewed, however can not obtain a bounty below the phrases.
Firedancer is retaining rewards obtainable and briefly growing them. Eligible findings obtain twice the usual payout by Nov. 20, 2026, or thrice the usual payout for Alpenglow consensus findings. Findings affecting solely pre-Alpenglow consensus obtain significantly diminished discretionary rewards. The deadline ends the increase, relatively than the bounty itself.
The Oct. 14 v26.10.2 launch consists of Alpenglow help enabled in default testnet and devnet configurations.
The duplicate queue had a evaluate drawback
Bhatt’s account of the spring contest explains why the fee change reaches past spam deterrence.
He reviews 809 whole submissions from 162 researchers, leading to 127 distinctive safety submissions outdoors the competition’s perception class. Practically half of legitimate submissions had been duplicates. The 127 determine counts distinct non-insight submissions; the duplicate share refers back to the broader pool of legitimate submissions.
His extra revealing figures concern the queue. At roughly 26 submissions a day, the backlog peaked at 299 open reviews. Round 80% of duplicate submissions arrived greater than three days after the first report, he says.
Bhatt describes a suggestions loop. Earlier findings remained unfixed or undisclosed whereas evaluate lagged, leaving different researchers to find and submit the identical issues. These reviews added extra evaluate work. Duplicate submissions declined because the workforce’s triage caught up, in keeping with his account.
Bhatt additionally says the workforce believes almost each contest report was found or written by an agent. He suggests researchers utilizing related fashions converged on the identical bugs.
CryptoSlate reported an identical filing-risk problem in August throughout Anza’s separate Alpenglow competitors, which required a 0.5 SOL burn per report. Firedancer’s retrospective provides a particular operational lesson: its personal evaluate backlog helped maintain alternatives for repeated discovery open.
In his Jan. 26 account of curl’s bounty closure, Daniel Stenberg rejected charging researchers at that time partly due to administrative friction and the chance of deterring authentic reporters. He introduced the bounty would cease Jan. 31 whereas non-public safety reporting continued.
The helpful take a look at is what reaches a repair
Bhatt’s retrospective describes a high-severity scheduling discovering that would make Firedancer execute transactions in a distinct order and diverge from different validator purchasers.
Firedancer has modified components of that course of. Bhatt says the workforce is documenting system invariants extra explicitly for automated auditors. The reside kind permits 3,000 characters every for the vulnerability description, replica steps, influence and proof of idea, with a 1,024-character abstract. Clearer assumptions may help researchers assess a suspected bug; concise replica directions may help reviewers act on it.
The present phrases additionally inform researchers to count on contact by a GitHub Safety Advisory inside 96 hours after submission and affirmation of the required burn. That expectation covers preliminary contact. It provides no deadline for validating the assault, getting ready a patch or deploying a repair.
