Firedancer Requires a 1 SOL Burn for Every Bug Bounty Report

Jump Crypto’s Firedancer bug bounty requires researchers to burn 1 Solana (SOL) token with every submission, including invalid, out-of-scope and duplicate reports, adding a nonrefundable cost to each attempt.

The rule took effect Sunday, Oct. 18. Reports submitted without the burn may still be reviewed but cannot receive a bounty. For repeated or similar issues, the first submission generally gets the reward. A later report can qualify if it shows greater impact or a wider surface area, corrects an incomplete or mistaken earlier report, or is considered a high-quality finding.

The policy differs from Firedancer’s spring contest, which ran from April 9 to May 9, 2026. It charged $100 per submission and capped researchers at one report per day, while allowing eligible duplicate reports to earn rewards. The primary finder received a larger share. The 30-day contest drew 809 reports from 162 researchers and produced 127 unique, non-insight security submissions; nearly half of valid submissions were duplicates.

Submissions averaged about 26 a day, and the backlog peaked at 299 open reports. About 80% of duplicate reports arrived more than three days after the primary submission. Ishan Bhatt said, “The biggest bottleneck was managing the volume of reports.” Earlier reports could remain unresolved as similar findings arrived.

Firedancer is an independent validator client for Solana. By Oct. 16, it had launched on mainnet and secured 15% of the network’s stake.

Once a report and its SOL burn are confirmed, the team expects to contact the researcher within 96 hours using a GitHub Security Advisory. The terms set no deadline for validating reports or fixing bugs.

Firedancer’s reward boosts run through Nov. 20. Eligible reports receive twice the standard payout, while Alpenglow-specific findings receive three times the standard payout. Nov. 20 marks the end of the boosts, not the bounty program.