Anza is charging security researchers a non-refundable 0.5 SOL to file each Alpenglow bug report before the competition closes at 16:00 UTC on Aug. 19. The upfront fee applies before Anza rules on a report's eligibility, severity, or duplication, and a substantiated loss-of-funds flaw can unlock a 50,000 SOL pool.
Anza requires every finding to pass through a designated portal that burns the 0.5 SOL fee and creates one confidential GitHub Security Advisory. Reports filed through another channel are ineligible.
A migration-scoped bounty
Alpenglow was excluded from Agave's standing bounty during development, monorepo migration, and internal-audit phases. SIMD-0326 proposes Alpenglow as a backwards-incompatible replacement for Solana's current Proof-of-History and TowerBFT consensus protocol. The two-week competition opens the Votor voting engine, vote and certificate messages, BLS signature and certificate verification, the TowerBFT migration path, and specified validator integration surfaces.
Public or previously disclosed issues do not qualify, nor do known issues, test code, third-party cryptography dependencies, or ordinary TowerBFT-only paths. Researchers must demonstrate findings on a local fork, multi-node harness, or simulation — mainnet and public-testnet attacks are unauthorized.
Priority goes to evidence, not timing
The earliest report that clears the proof-of-concept bar at Anza's assessed severity wins the award for that root cause; a placeholder reserves nothing, and later duplicates get paid only if they substantiate a strictly higher severity. Eligibility also ends the moment a fix reaches Agave master, so a report can lose its payout chance mid-competition even after reproducing the flaw on an earlier commit.
Anza's rules set a 50,000 SOL pool for loss-of-funds findings, the largest of four tiers: DoS or other issues unlock 10,000 SOL, liveness or availability loss unlocks 20,000 SOL, and consensus or safety violations unlock 30,000 SOL. Individual awards run smaller — loss-of-funds pays 6,250 to 25,000 SOL, consensus or safety violations 3,125 to 12,500 SOL, liveness findings 1,250 to 5,000 SOL, and DoS findings 315 to 1,250 SOL, and Anza reduces awards proportionally if combined claims exceed the unlocked pool.
Payment follows the Sept. 2 adjudication close and KYC, arriving as a lump sum in SOL locked for 12 months under the standing Agave bounty terms. The filing burn is immediate; compensation depends on later adjudication and stays illiquid for a year. As of Aug. 18, the official rules and overview still listed Aug. 19 as the cutoff, with no extension notice on either page.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
