Firedancer, Leap Crypto’s impartial validator software program for Solana, requires researchers to burn 1 SOL to qualify for a bug bounty beneath phrases efficient Oct. 18. The burn is non-refundable even when a report identifies an actual vulnerability that another person submitted first.
The change narrows the path to cost for later finders in contrast with Firedancer’s spring audit contest. In an Oct. 16 retrospective for Leap Crypto, Ishan Bhatt partly attributes the duplicate-report downside to the crew’s personal evaluate delays: researchers saved discovering bugs whereas earlier experiences waited for motion.
The present phrases usually award the primary submission about the identical situation or an identical variant, whereas preserving discretionary rewards for some later experiences.
An actual bug can nonetheless depart its finder out of pocket
Firedancer’s earlier Immunefi contest ran April 9–Could 9, 2026. Its revealed guidelines explicitly made duplicate experiences of an unfixed bug eligible for rewards. As soon as a repair was publicly disclosed, new experiences grew to become invalid, whereas experiences submitted earlier than the repair remained eligible.
That was already a paid submission system. In his Oct. 16 Hardening Firedancer retrospective, Bhatt says the competition charged $100 per report and imposed a restrict of 1 submission per researcher a day. The October improvement is a unique price construction paired with narrower duplicate eligibility.
| Rule | April–Could contest | Present Firedancer bounty |
|---|---|---|
| Submission price | $100 per report, in keeping with Bhatt | Non-refundable 1 SOL burn for bounty eligibility |
| Duplicate eligibility | Unfixed duplicates eligible earlier than public disclosure of a repair | First submission usually receives the reward; later-report exceptions stay discretionary |
| Researcher publicity | A qualifying later report may share in contest rewards | The burn stays a price even when a replica earns no reward |
A later researcher could earn a reward by demonstrating higher influence or a wider affected floor. An incomplete first submission, or one resting on incorrect assumptions, could enable a later report back to turn out to be the chief discovering. The crew may reward high-quality later work.
Eligibility additionally extends past duplicate standing. The phrases deal with related public repository materials, together with code feedback, pull requests and mitigating modifications on public branches, as recognized points. Privately recognized points that demonstrably predate a report obtain case-by-case consideration. The baseline proof-of-concept necessities name for a reproducible end-to-end assault towards the allowed department and configuration, displaying sensible influence, topic to specified discretionary exceptions.
The submission kind describes an irreversible switch to an incinerator pockets. The phrases additionally make the burn non-refundable for invalid and out-of-scope experiences. This can be a price burned by the researcher; Leap doesn’t gather it as price income. Experiences and not using a burn could or will not be reviewed, however can’t obtain a bounty beneath the phrases.
Firedancer is maintaining rewards obtainable and quickly growing them. Eligible findings obtain twice the usual payout by Nov. 20, 2026, or thrice the usual payout for Alpenglow consensus findings. Findings affecting solely pre-Alpenglow consensus obtain tremendously lowered discretionary rewards. The deadline ends the increase, quite than the bounty itself.
The Oct. 14 v26.10.2 launch consists of Alpenglow help enabled in default testnet and devnet configurations.
The duplicate queue had a evaluate downside
Bhatt’s account of the spring contest explains why the cost change reaches past spam deterrence.
He experiences 809 whole submissions from 162 researchers, leading to 127 distinctive safety submissions exterior the competition’s perception class. Almost half of legitimate submissions had been duplicates. The 127 determine counts distinct non-insight submissions; the duplicate share refers back to the broader pool of legitimate submissions.
His extra revealing figures concern the queue. At roughly 26 submissions a day, the backlog peaked at 299 open experiences. Round 80% of duplicate submissions arrived greater than three days after the first report, he says.
Bhatt describes a suggestions loop. Earlier findings remained unfixed or undisclosed whereas evaluate lagged, leaving different researchers to find and submit the identical issues. These experiences added extra evaluate work. Duplicate submissions declined because the crew’s triage caught up, in keeping with his account.
Bhatt additionally says the crew believes almost each contest report was found or written by an agent. He suggests researchers utilizing comparable fashions converged on the identical bugs.
CryptoSlate reported an identical filing-risk situation in August throughout Anza’s separate Alpenglow competitors, which required a 0.5 SOL burn per report. Firedancer’s retrospective provides a particular operational lesson: its personal evaluate backlog helped preserve alternatives for repeated discovery open.
In his Jan. 26 account of curl’s bounty closure, Daniel Stenberg rejected charging researchers at that time partly due to administrative friction and the chance of deterring legit reporters. He introduced the bounty would cease Jan. 31 whereas non-public safety reporting continued.
The helpful check is what reaches a repair
Bhatt’s retrospective describes a high-severity scheduling discovering that would make Firedancer execute transactions in a unique order and diverge from different validator purchasers.
Firedancer has modified components of that course of. Bhatt says the crew is documenting system invariants extra explicitly for automated auditors. The reside kind permits 3,000 characters every for the vulnerability description, replica steps, influence and proof of idea, with a 1,024-character abstract. Clearer assumptions might help researchers assess a suspected bug; concise replica directions might help reviewers act on it.
The present phrases additionally inform researchers to anticipate contact by a GitHub Safety Advisory inside 96 hours after submission and affirmation of the required burn. That expectation covers preliminary contact. It provides no deadline for validating the assault, making ready a patch or deploying a repair.
