Solana Introduces 1 SOL Fee for Bug Reports to Combat AI-Generated Spam

Solana’s Firedancer development team has introduced a mandatory 1 SOL fee for every bug report after a monthlong security competition received 809 submissions, with artificial intelligence believed to have assisted in generating or writing nearly all of them.

The move is intended to reduce low-quality submissions and help engineers focus on legitimate vulnerabilities. Researchers must now permanently burn 1 SOL, worth approximately $100, for each report submitted to the program.

Under rules updated Monday, the fee is nonrefundable, even if a submission proves invalid, falls outside the program’s scope, or duplicates a previously reported issue. Reports submitted without burning the required tokens will not qualify for rewards.

Jump Crypto, the trading firm behind Firedancer, developed the software as an alternative to Agave, the primary client used by computers that validate and process transactions on the Solana network.

A critical software flaw can prevent validators from processing transactions correctly or cause them to disagree about account balances and network state. A large volume of duplicate or unusable reports can consume engineering resources that would otherwise go toward identifying and fixing genuine security problems.

AI-Generated Reports Prompt New Security Rules

The policy change follows a $1 million security audit competition that ran from April 9 to May 9. The event attracted 809 submissions from 162 researchers and uncovered 127 unique security findings, excluding observations that could not be exploited. Nearly half of the valid reports were duplicates.

Jump believes AI agents played a role in discovering or drafting almost every submission.

“AI has made finding bugs cheap, but judging them is still expensive,” Jump’s Ishan Bhatt wrote in an Oct. 16 review.

Engineers were still required to reproduce the reported issues and determine whether the proposed exploits could actually work. Some submissions identified apparent weaknesses without accounting for safeguards elsewhere in the software.

The review backlog eventually reached 299 unresolved reports. As assessments slowed, researchers began identifying vulnerabilities that had already been reported but had yet to be fixed or disclosed. Approximately 80% of duplicate submissions arrived more than three days after the original reports.

The competition had already imposed a $100 submission fee and restricted researchers to one report per day. Jump said the additional cost was intended to discourage speculative submissions that force engineers to spend time verifying questionable claims.

The updated reporting platform also limits each primary section of a submission to 3,000 characters, adding another restriction designed to keep reports concise.

Higher Rewards Target Critical Solana Vulnerabilities

Despite the challenges created by AI-assisted submissions, the competition uncovered several serious vulnerabilities.

One finding involved a scheduling error that could cause Firedancer to process transactions in the wrong order. This could lead its validators to reach a different view of the network’s state than other Solana validators, potentially disrupting transaction processing.

Jump is also increasing payouts to encourage researchers to continue reporting meaningful security issues despite the new submission cost.

Eligible findings will receive twice the standard reward through Nov. 20. Reports involving vulnerabilities specific to Alpenglow, Solana’s new voting system, can qualify for three times the usual payout.

Critical vulnerabilities affecting Alpenglow may be eligible for rewards of up to $300,000.

The revised policy reflects a growing challenge for security teams: AI can make vulnerability discovery and report generation faster, but verifying findings and distinguishing exploitable flaws from false alarms still requires significant engineering effort.

About The Author

ctleditor

See author's posts