AI wrote the bug reports, so filing one now costs 1 SOL

Researchers who report a bug in Firedancer, the independent Solana validator client built by Jump Crypto, must now burn SOL with every submission. CoinDesk puts the amount at 1 SOL, worth about $100, and reports that it is not refunded even when a report is invalid, out of scope or a duplicate. The bounty terms, in a version effective from 26 October, say that reports without an accompanying burn may or may not be reviewed but are not eligible for a bounty.

The reason is in Jump's own review of its $1 million public audit competition, which ran from 9 April to 9 May. In 30 days it received 809 reports from 162 researchers, producing 127 unique security submissions; nearly half of the valid ones were duplicates. That is roughly 20 times the volume of the earlier Frankendancer contest, which ran two weeks longer. Jump writes that it expected a roughly even mix of human and AI-assisted reports and instead believes nearly every submission was discovered or written by an agent. Reports grew longer too: 1,064 words on average excluding formatting and code, against 406 words for submissions to its programmes before 2025.

The cost landed on triage. At roughly 26 submissions a day, falling behind for a single day built a backlog that peaked at 299 open reports, and a new report was often followed by a wave of similar ones as different agents converged on the same bug. Jump's explanation for the duplicates is that agents using the same models reach the same findings. The contest already charged $100 per submission; Jump concluded the fee did not keep serious researchers away, while discouraging what it calls spray-and-pray hunters hoping to earn back their AI token spend several times over.

The fee comes with a larger reward. Until 20 November, eligible reports receive twice the standard payout for their severity, and findings specific to Alpenglow, Solana's new voting system, receive three times; CoinDesk puts critical Alpenglow findings at up to $300,000. Jump's assessment of the agents is balanced: they are good at catching places where Firedancer diverges from Agave or from documented invariants, and weak where the rules are implicit. Its answer is to document invariants for automated auditors as well as for engineers, and to enforce a length limit on reports.