Researchers who want to submit a bug report for Firedancer, Jump Crypto’s Solana validator client, now have to pay 1 SOL, roughly $100, to do it. The fee isn’t refundable. The SOL gets burned, so it leaves circulation for good, and that’s true even when the report is invalid, out of scope or a duplicate.
Jump blames AI for the change. The company thinks AI agents had a hand in finding or writing almost every report in its latest audit competition. Its engineers spent so long working through those submissions that genuine bugs sat unfixed.
“AI has made finding bugs cheap, but judging them is still expensive,” Ishan Bhatt of Jump said in an Oct. 16 review.
What the audit competition produced
Jump’s $1 million audit competition ran from April 9 to May 9. A total of 162 researchers sent in 809 reports.
From those 809 reports came 127 unique security findings, leaving out non-exploitable observations. Close to half of the valid submissions duplicated something already reported.
The competition wasn’t free to enter, either. Each submission cost $100, and researchers could file only one report per day. Spam still made it through.
A slow queue breeds duplicates
At its peak, the open report queue hit 299. An engineer had to reproduce each issue and confirm whether the described attack actually worked.
Many of them failed that test. Some reports flagged what looked like weaknesses but overlooked protections in other parts of the software. That’s the mistake you’d expect from a tool that reads a single file with no grasp of the full codebase.
Once reviews fell behind, the backlog grew on its own. Researchers kept finding bugs that someone had already reported but that were still unfixed or undisclosed. Roughly 80% of duplicates came in more than three days after the first report, which meant every delay on Jump’s side produced more redundant submissions.
What changes now
Terms updated Monday say a report filed without a 1 SOL burn isn’t eligible for a reward. According to Jump, the fee stops researchers from dumping big batches of speculative findings on the team and leaving engineers to figure out which ones hold up.
Each main report section on the new submission platform is also limited to 3,000 characters. The cap targets bloated write-ups, the kind a language model churns out when no one tells it to stop.
Why the noise matters
Firedancer is an alternative to Agave, the main software running on the computers that verify and process Solana transactions. Bugs in either one can cause real harm.
A serious flaw could halt those validators from processing payments or leave them disagreeing over account balances, which disrupts trades and transfers. When engineers are stuck on hundreds of duplicate or broken reports, they have less time to find and fix those exact problems.
The spring competition did surface serious bugs. In one case, a scheduling error could cause Firedancer to run transactions in the wrong order and end up disagreeing with other Solana validators about the resulting network state. The program exists to catch bugs like that one, and they’re the ones that get lost when junk fills the queue.
Bigger rewards alongside the fee
Jump is adding the fee and raising payouts at once. Eligible findings earn double the standard amount through Nov. 20.
Bugs tied to Alpenglow, Solana's new voting system, pay triple the standard amount. Critical Alpenglow findings can qualify for as much as $300,000.
For a researcher holding a real, reproducible Alpenglow bug, the trade is simple: burn about $100 for a chance at $300,000. Anyone pasting model output into the form and hoping for a hit now loses 1 SOL on every miss.