Firedancer, Jump Crypto's validator software for Solana, now requires researchers to burn 1 SOL to qualify for a bug bounty, even if the report turns out to be a duplicate. The change follows a spring audit contest in which review delays helped produce many repeat submissions.
Firedancer, Jump Crypto's independent validator software for Solana, requires researchers to burn 1 SOL to qualify for a bug bounty under terms effective Oct. 18. The burn is non-refundable even when a report identifies a real vulnerability that someone else submitted first.
Duplicate rules tighten after the spring contest
Firedancer's earlier Immunefi contest ran April 9–May 9, 2026, and its published rules made duplicate reports of an unfixed bug eligible for rewards. The current terms, by contrast, generally award the first submission about the same issue or a similar variant, while preserving discretionary rewards for some later reports.
The old system was already paid. In an Oct. 16 retrospective, Ishan Bhatt says the contest charged $100 per report and limited each researcher to one submission a day. The new fee is a different structure paired with narrower duplicate eligibility.
The burn is an irreversible transfer to an incinerator wallet, according to the submission form. Jump does not collect it as fee revenue, and the terms make it non-refundable for invalid and out-of-scope reports as well.
Review delays fed the duplicate queue
Bhatt partly attributes the duplicate problem to the team's own review lag. He reports 809 total submissions from 162 researchers, resulting in 127 unique security submissions outside the contest's insight category.
At roughly 26 submissions a day, the backlog peaked at 299 open reports, and around 80% of duplicates arrived more than three days after the primary report, he says. Earlier findings stayed unfixed while review lagged, so other researchers found and submitted the same problems.
Rewards rise while the process stays open-ended
Firedancer is keeping rewards available. Eligible findings receive twice the standard payout through Nov. 20, 2026, or three times the standard payout for Alpenglow consensus findings.
The terms also tell researchers to expect contact through a GitHub Security Advisory within 96 hours after submission and confirmation of the burn. That window covers initial contact only and sets no deadline for a patch or fix.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
