Solana bug reports now cost 1 SOL as AI floods security teams with spam

The Firedancer software team for Solana has mandated that researchers must now permanently burn 1 SOL for every bug report submitted. This measure is intended to combat spam and lessen the review load caused by AI-generated submissions.

The cost of 1 SOL, which is valued at about $100, is nonrefundable under updated terms from Monday, even if a report is invalid, falls outside the program's scope, or duplicates a prior discovery. Submissions without this burn are ineligible for any rewards.

This action follows an audit competition held between April 9 and May 9, which generated 809 reports from 162 researchers. Of these, only 127 unique security findings were identified, with almost half of the valid submissions being duplicates.

Jump Crypto, which developed Firedancer as an alternative to Agave, noted that AI agents likely helped write or discover nearly every submission. Ishan Bhatt of Jump stated in an Oct. 16 review, “AI has made finding bugs cheap, but judging them is still expensive.”

Engineers still needed to verify reported issues and confirm if proposed attacks could actually function. The backlog of open reports reached a high of 299. Furthermore, about 80% of the duplicate reports appeared more than three days after the initial submission.

To counter the influx, Jump stated that charging discourages researchers from submitting numerous speculative findings, allowing engineers to focus on validation. The new platform also imposes a limit of 3,000 characters for each main report section.

Despite the spam, the competition uncovered serious flaws, including a scheduling error that could cause Firedancer to execute transactions out of sequence and disagree with other Solana validators regarding network state.

Concurrently, Jump is increasing rewards. Eligible findings will receive double the standard payout through Nov. 20, and three times the payout for bugs related to Alpenglow, Solana’s new voting system. Critical Alpenglow findings might qualify for up to $300,000.