Anza Announces Alpenglow Bug Bounty Competition Before Solana Consensus Mainnet

Anza plans to run a bug bounty competition for Alpenglow later this summer before Solana's new consensus protocol transitions to mainnet, the core development team announced on July 17. Full scope, reward tiers, and exact dates have not yet been disclosed. The team says details are coming through the official Anza account and the Alpenglow GitHub repository.

Four Alpenglow Components in Scope

The competition targets four modules in the anza-xyz/agave codebase, covering the core voting and cryptographic layers of the Alpenglow stack:

• votor: the voting engine responsible for block finalization
• votor-messages: vote and certificate message types that votor processes
• bls-sigverify: BLS signature verification
• bls-cert-verify: certificate verification and stake-threshold checking

Researchers will submit findings via GitHub's private vulnerability reporting feature. The scope is deliberate: Alpenglow code was excluded from Agave's existing bug bounty program during the protocol's development, monorepo migration, and internal audit phases. The dedicated competition covers the gap. Issues discovered in prior development are tracked on the Agave repository under the blocking-ag and consensus-team labels, giving researchers a record of what the team has already addressed.

Alpenglow Architecture: Votor, Rotor, and the Mainnet Security Gate

Alpenglow replaces Tower BFT and Proof of History with two new components. Votor handles voting and block finalization; Rotor handles block propagation, extending Solana's existing Turbine architecture. Together they target finality in around 150 milliseconds at median, compared to the current 12.8 seconds, according to the Anza technical paper.

Votor runs two concurrent voting paths. An 80% fast path finalizes a block in a single round when 80% of staked validators respond; a 60% fallback path finalizes in two rounds when only 60% of stake is responsive, with finality landing as soon as either path completes. The protocol is designed to tolerate up to 20% adversarial stake alongside up to 20% non-responsive stake simultaneously, per the Anza technical paper.

Alpenglow also removes on-chain vote transactions from the ledger. Validators currently consume a significant share of block space submitting continuous votes; Alpenglow routes that communication off-ledger, freeing capacity for user transactions.

Community testing has been running since May 2026. In late June, Overclock Validator's Mithril client produced blocks on the Alpenglow test cluster, bringing a Go-based fourth validator client into the test environment alongside existing Agave and Firedancer implementations.

The BLS components at the center of the bounty scope handle the signature verification and stake-threshold checks that finality depends on. Running an external competition against those four modules before activation is the standard security process for consensus-layer code at this depth. With the mainnet window described as later this year, the bounty marks the start of the final pre-launch audit phase.