Solana Firedancer now requires 1 SOL burn per bug report due to AI spam

This measure is intended to curb spam and lessen the review burden from AI-generated reports.

This change follows a recent audit competition that yielded 809 reports but only 127 unique security findings. Furthermore, almost half of the valid submissions were duplicates of earlier reports.

Trading firm Jump Crypto developed Firedancer as an alternative to Agave, the primary software used for validating Solana transactions. A significant flaw in this software could halt payment processing or cause disagreements regarding account balances, thereby disrupting transfers.

The cost of 1 SOL, roughly equivalent to $100, must be permanently burned, removing the tokens from circulation. Under the updated terms effective Monday, this fee is nonrefundable, even if the report is invalid, outside the program's scope, or a duplication. Submissions lacking this burn are ineligible for any rewards.

A $1 million audit competition, running from April 9 to May 9, attracted 162 researchers. Jump Crypto believes that AI agents were instrumental in discovering or authoring nearly all the submissions. Ishan Bhatt of Jump noted in an Oct. 16 review, “AI has made finding bugs cheap, but judging them is still expensive.”

The competition revealed serious issues, including a scheduling error that could cause Firedancer to execute transactions out of sequence and conflict with other Solana validators regarding the resulting network state.

To incentivize genuine discovery, Jump is concurrently increasing rewards. Eligible findings will receive double the standard payout until November 20, or triple the payout for bugs specific to Alpenglow, Solana’s new voting system. Critical Alpenglow findings may qualify for up to $300,000.

The increased fee and platform limitations—such as restricting each main report section to 3,000 characters—are designed to discourage the submission of numerous speculative findings, allowing engineers to focus on validation.

These developments illustrate a growing operational challenge for decentralized infrastructure projects, where the efficiency gains from generative AI are colliding with the intensive, human-centric verification demands of protocol-level security auditing.

Why it matters

This development highlights the increasing challenge of vetting security reports as generative AI floods the ecosystem with low-quality submissions. For DeFi and L2 infrastructure, the efficiency of vulnerability discovery is critical to maintaining protocol security. Readers should watch how this cost-based filtering impacts the overall quality and speed of security auditing for major chains.