Solana bug reports now cost 1 SOL as AI floods security teams with spam
Researchers must now permanently burn 1 SOL for every submission after a monthlong contest drew 809 reports, with AI believed to have helped generate or write nearly all of them.
A flood of AI-assisted bug reports has prompted the team behind Solana’s Firedancer software to charge researchers 1 SOL, worth about $100, per submission, aiming to cut spam and give engineers more time to investigate genuine security flaws.
The tokens must be burned, which permanently removes them from circulation. Under terms updated Monday, the cost is nonrefundable even if a report is invalid, outside the program’s scope or duplicates an earlier finding. Reports submitted without a burn are ineligible for rewards.
Trading firm Jump Crypto built Firedancer as an alternative to Agave, the main software used by the computers that check and process Solana transactions.
A serious flaw can stop those computers processing payments or make them disagree about account balances, disrupting trades and transfers. Hundreds of duplicate or unworkable reports take engineers’ time away from investigating and fixing those vulnerabilities.
A $1 million audit competition held between April 9 and May 9 attracted 809 reports from 162 researchers. Those produced 127 unique security findings, excluding non-exploitable observations. Nearly half of valid submissions were duplicates.
“AI has made finding bugs cheap, but judging them is still expensive,” Jump’s Ishan Bhatt wrote in an Oct. 16 review.
Engineers still had to reproduce reported problems and check whether the proposed attacks could work. Some submissions flagged apparent weaknesses while missing protections elsewhere in the software.
The backlog peaked at 299 open reports. As reviews slowed, other researchers rediscovered bugs that had already been submitted but remained unfixed or undisclosed. About 80% of duplicates arrived more than three days after the original report.
The competition had already charged $100 per submission and limited researchers to one report a day. Jump says charging discourages researchers from submitting large numbers of speculative findings and leaving its engineers to validate them.
The competition uncovered serious vulnerabilities, including a scheduling error that could make Firedancer execute transactions in the wrong order and disagree with other Solana validators about the resulting network state.
Meanwhile, Jump is increasing rewards alongside the submission cost. Eligible findings receive twice the standard payout through Nov. 20, or three times for bugs specific to Alpenglow, Solana’s new voting system. Critical Alpenglow findings can qualify for up to $300,000.
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Asanat Analysis — Why it matters
Solana's shift to a 1 SOL burn per bug report reflects a real operational constraint: the Solana Foundation's security team faced unsustainable volume after a monthlong contest generated 809 submissions, most AI-assisted. This is a rational economic response—burning tokens as a fee mechanism raises the cost of noise while funding security operations via scarcity. However, it signals a secondary problem: the ease with which LLMs can now generate plausible-sounding (if often low-quality) vulnerability reports faster than humans can triage them, inverting the typical bug bounty dynamic where scarcity of skilled researchers was the bottleneck.
The precedent matters for the broader security landscape. As AI tools lower the friction for generating technical submissions across software, cryptocurrency, and other domains, we should expect more projects to adopt similar friction-raising mechanisms—whether token burns, proof-of-work challenges, or staged review gates. For Solana specifically, this also highlights the tension between the network's emphasis on accessibility and the emerging need for gatekeeping when automation commoditizes participation. The 1 SOL burn is both a fund-raising mechanism and a signal: meaningful security contributions still require human judgment, and that has a price.
From a market perspective, this reinforces that Solana's security infrastructure remains under active stress, even as the network's operational maturity has grown. The flood of low-signal reports suggests the foundation's threat model now includes coordinated noise as a denial-of-service vector against their own security processes—a novel failure mode as AI proliferates.