Solana Tightens Security Reporting Rules as AI Floods Teams With False Alerts

Solana’s Firedancer security team has made researchers pay a nonrefundable 1 SOL fee for each bug report after an audit contest attracted 809 submissions, with artificial intelligence believed to have contributed to nearly all of them.

The new requirement is intended to filter out spam and reduce the workload on engineers reviewing potential vulnerabilities. At approximately $100 per submission, the fee must be permanently burned. Researchers will not receive a refund if a report is invalid, outside the program’s scope, or duplicates an existing finding. Reports submitted without the token burn are ineligible for rewards.

Jump Crypto developed Firedancer as an alternative to Agave, the main validator software used to process transactions on the Solana network.

Bugs in validator clients can disrupt transaction processing or cause validators to disagree about account balances and the network’s state. An overwhelming number of duplicate or unworkable reports can divert engineering resources from fixing genuine security weaknesses.

AI-Generated Submissions Overload Bug Review Process

The updated rules follow a $1 million security audit contest conducted from April 9 to May 9. The competition received 809 reports from 162 researchers and identified 127 unique security findings after excluding issues that could not be exploited. Nearly half of the valid submissions were duplicates.

Jump believes AI agents assisted in discovering or drafting almost every report.

In an Oct. 16 review, Jump’s Ishan Bhatt highlighted the growing gap between identifying potential bugs and verifying them. While AI has made generating findings cheaper, assessing their validity still requires significant engineering work.

Reviewers must reproduce each reported issue and establish whether the suggested attack is feasible. Some submissions identified apparent vulnerabilities without considering protective mechanisms elsewhere in the software.

The backlog reached 299 open reports at its peak. As the review process slowed, researchers submitted additional reports for vulnerabilities already awaiting investigation or disclosure. About 80% of duplicate submissions arrived more than three days after the original report.

The contest had already charged $100 per submission and limited researchers to one report daily. Jump introduced the latest restrictions to discourage speculative findings that force engineers to spend time checking claims with little security value.

The reporting platform now also limits each main section of a submission to 3,000 characters.

Higher Bounties Encourage Researchers to Find Critical Bugs

Despite the review burden, the competition identified serious vulnerabilities, including a transaction scheduling flaw that could cause Firedancer to execute transactions in the wrong order.

The error could lead Firedancer validators to disagree with other Solana validators about the resulting network state, potentially affecting transaction consistency.

Jump is increasing rewards to maintain incentives for researchers who uncover meaningful security issues. Eligible findings will receive double the standard payout through Nov. 20, while vulnerabilities specific to Alpenglow, Solana’s new voting system, qualify for triple rewards.

Critical Alpenglow vulnerabilities can earn researchers up to $300,000.

The revised policy reflects the growing pressure AI-assisted submissions are placing on security teams. Although automated tools can accelerate vulnerability discovery and report writing, engineers must still determine which findings represent genuine, exploitable threats.