Firedancer Bug Bounty Platform Goes Live With 3x Rewards for Alpenglow Findings After Jump's $1M Audit Contest

The Firedancer team at Jump Crypto opened its own bug bounty platform on 16 October 2026, and until 20 November it pays double rewards on every valid report and triple for findings related to Alpenglow, Solana SOL$103.56-2.4%'s new consensus protocol. The terms are on the Firedancer bug bounty site itself, and the official Firedancer account announced the launch at 17:37 UTC. Alongside it, Jump published "Hardening Firedancer", a postmortem of its $1 million public audit contest that received 809 reports and, in Jump's view, very few written without an AI agent.

The timing is pointed. Alpenglow is scheduled to go live on mainnet five days later, and Jump says Firedancer now secures 15% of the network's stake (as of its post), so the code the higher rewards target is either already carrying real stake or about to.

How the Firedancer bug bounty works: GitHub sign-in, 3,000-character limits and a 1 SOL burn

The Firedancer bug bounty platform takes reports directly, where Jump's earlier programs ran through Immunefi. Researchers sign in with GitHub, accept the program's terms, and fill in a summary capped at 1,024 characters plus four sections (vulnerability description, steps to reproduce, impact and proof of concept) capped at 3,000 characters each. They pick a severity from Low to Critical.

Every submission costs a non-refundable fee, paid by burning SOL to an incinerator address, which destroys the tokens so nobody receives the fee. Jump's post puts the burn at 1 SOL per submission. The platform page warns that the burn is permanent and tells researchers not to run the command more than once.

The page and the blog post set out the multipliers but not the base reward schedule they multiply, and neither defines the Alpenglow scope beyond "findings related to Alpenglow."

Jump describes Firedancer as a fully independent validator client for Solana, separate from Anza's Agave client. According to Jump's post, it previously ran a Frankendancer contest in 2024 and an open Frankendancer bounty on Immunefi for two years. "Now, we run our own program for Firedancer," the post says.

Firedancer audit contest results: 809 reports from 162 researchers

Jump's $1 million Firedancer audit contest ran through Immunefi from 9 April to 9 May 2026 and received 809 reports from 162 researchers, according to Jump's postmortem. Those reduced to 127 unique security findings once insight-level reports were excluded, and nearly half of the valid submissions were duplicates of something already reported.

The prize pool unlocked in steps based on the worst bug found: $100,000 at minimum, $250,000 with at least one medium, $500,000 with a high, and the full $1 million only for a critical. Jump charged a $100 fee per submission and capped each researcher at one report a day, rewarded duplicates with a smaller share than the first finder, and set aside 10% of the pool for the top three submitters.

Neither the total paid out nor the tranche that unlocked appears in Jump's post; the most severe bug it describes is rated High.

Volume was the surprise. By Jump's count, the contest drew roughly 20 times the reports of its Frankendancer contest, which ran two weeks longer. The reports were longer too: 1,064 words on average excluding formatting and code, and 2,610 including everything, against an average of 406 words for reports to Jump's bounty programs before 2025.

The Firedancer bugs: a consensus divergence, a repair-tile stall and a slow memory leak

The most serious bug Jump describes is a High-severity flaw in how Firedancer's replay dispatcher orders the transactions inside a block. Firedancer runs transactions that touch different accounts in parallel, and a priority score decides which goes first. The dispatcher tracked how recently each account was used with a 24-bit counter, and when the gap wrapped around to an exact multiple of 2^24 it read as zero. That could push the score negative and let a transaction run ahead of one it was supposed to wait for.

Run a block in a different order and you can get a different result. Jump says the bug would have made Firedancer nodes deterministically execute a block out of order and diverge from other clients on consensus, and that a remote attacker could feasibly have triggered it. The report fell short of critical because, in Jump's words, "the attack couldn't be precise enough to cause predictable, serious harm."

Two clients disagreeing over a block's result is the specific risk that comes with running more than one client on the same network, and Jump's contest rules rank any bug that could cause an execution or consensus divergence as High.

The two other examples were narrower:

• A Medium bug in the repair tile, the component that rebuilds blocks from pieces arriving out of order. A stale pointer could form a loop in its tree of blocks, stalling that node's repair process. Jump rated it Medium because network timing meant an attacker could not trigger it across the cluster reliably.
• A Low bug in the hard fork detector, which watches votes to spot when a node has split from the majority. Blocks that received no votes were never freed, so memory leaked until the validator crashed. Jump says that would take months of continuous running, or an attacker with substantial stake producing hundreds of thousands of invalid blocks.

What Jump learned about AI-generated bug reports

Jump went into the contest expecting a roughly even mix of human and AI-assisted reports.

Jump says nearly every submission was either found or written by an AI agent, and that agents using the same models converged on the same bugs, which drove the duplicate rate. In Jump's account, agents were good at spotting places where Firedancer differs from the matching Agave code, or where code breaks a documented rule. They were poor at unwritten rules. Several reports assumed a Firedancer node could hold unconfirmed state spanning multiple epoch boundaries. Firedancer caps that state at 2,048 slots (about 10 minutes), while an epoch lasts 432,000 slots (about a day), so at most one boundary can fall inside the window.

Triage became the bottleneck. Jump says it took about 26 submissions a day and its backlog peaked at 299 open reports. Around 80% of duplicates arrived more than three days after the original, because unfixed, undisclosed bugs kept getting rediscovered by other agents.

Those lessons shape the new platform. The contest's $100 fee did not deter serious researchers, Jump argues, and without it there would have been more reports of lower quality; hence the 1 SOL burn. The 3,000-character cap targets what Jump calls "thousand-word, AI-generated reports with buried ledes." A fee like this works like postage: trivial for someone sending one considered letter, expensive for someone mailing thousands. Jump also recommends documenting invariants for automated auditors and running an agent over every submission as a first filter, noting that "we never saw an LLM discard a valid finding."

Jump places the contest in a wider trend: it cites Mozilla making 423 security fixes in April 2026, about 20 times its prior monthly average, and notes that some bounty programs elsewhere have cut payouts or shut down under AI-driven volume.

Why Jump's 3x Alpenglow bounty lands five days before mainnet

Anza has scheduled Alpenglow to go live on mainnet-beta around 14:50 UTC on Wednesday 21 October, describing it as "18 months of work for a migration that happens in one slot" that cuts finality "from seconds to ~150ms." We covered that schedule when Anza set the Alpenglow mainnet date, and the client release validators are asked to run in Anza's Agave v4.3.2 recommendation.

A one-slot migration reaches every validator on the network at once. In epoch 1059, which began on 16 October, Solana had 678 validators holding about 439 million staked SOL, according to Solana Compass stake data.

Anza announced its own Alpenglow bug bounty competition in July. Jump's tripled rewards add a second open program pointed at the same upgrade, and they run for about a month after the scheduled activation, so they cover Alpenglow's first weeks on mainnet.

For the 15% of stake Jump says runs Firedancer, the contest showed that an open bounty can surface consensus-level bugs. It also showed that most of the cost now sits with whoever reads the reports. The new platform's fee, length limits and AI first pass are Jump's attempt to keep that cost down while it doubles and triples what it pays per bug.