Firedancer makes bounty hunters burn 1 SOL even for duplicate bug reports

The new policy requires an irreversible 1 SOL transfer to an incinerator wallet for each submission, regardless of whether the report identifies a valid vulnerability that was previously discovered. This fee structure differs significantly from Firedancer's earlier Immunefi contest in April 2026, which charged $100 per report but allowed rewards for duplicate submissions of unfixed bugs.

The change comes after Jump Crypto's retrospective analysis of their spring audit contest revealed significant challenges with duplicate submissions. In his Oct. 16 retrospective, Ishan Bhatt, a Jump Crypto team member, noted that 809 total submissions resulted in only 127 unique security submissions, with nearly half of valid submissions being duplicates.

Review backlog fueled duplicates

Bhatt attributed the duplicate problem to the team's own review delays, creating a feedback loop where unfixed bugs remained discoverable. At peak, the backlog reached 299 open reports with approximately 26 submissions arriving daily. About 80% of duplicate submissions came more than three days after the primary report, suggesting researchers kept finding bugs while earlier reports awaited action.

Stricter eligibility criteria

Under the current terms, only the first submission about an issue or similar variant typically qualifies for rewards, though the team maintains discretion to reward later submissions that demonstrate greater impact or higher quality. The policy treats public repository material—including code comments, pull requests, and mitigating changes—as known issues that disqualify new reports.

Researchers must provide a reproducible end-to-end attack showing practical impact, with some discretionary exceptions. The submission form explicitly states the 1 SOL burn is non-refundable for invalid and out-of-scope reports, though Jump Crypto does not collect this as revenue. Reports without the burn may still be reviewed but cannot receive bounties.

Temporary reward increases

To encourage participation despite the higher barrier, Firedancer has temporarily increased rewards. Eligible findings receive twice the standard payout through Nov. 20, 2026, or three times the standard payout for Alpenglow consensus findings. Findings affecting only pre-Alpenglow consensus receive greatly reduced discretionary rewards. The Oct. 14 v26.10.2 release includes Alpenglow support enabled in default testnet and devnet configurations.

Bhatt also noted that the team believes nearly every contest report was discovered or written by an agent, suggesting researchers using similar AI models converged on the same bugs. This observation aligns with similar issues reported during Anza's separate Alpenglow competition in August, which required a 0.5 SOL burn per report.