Firedancer bug bounty with boosted rewards until November 20, 2026

Jump Crypto has opened its own bug bounty platform for Firedancer, its validator client for Solana. The team built it after a $1M public audit contest that drew 809 reports.

Base payouts are $50k to $100k for critical issues, $10k to $50k for high, $5k to $10k for medium and $1k to $5k for low. Until November 20, 2026, eligible reports get twice the standard payout, and findings specific to Alpenglow get three times. That puts a critical Alpenglow finding at up to $300k. Findings that only affect consensus from before Alpenglow get much lower rewards.

In scope is any reachable code in the firedancer binary on the specified tag with the allowed configuration. Frankendancer and fdctl, Solana protocol bugs (those go to Agave), trusted data sources and Clang builds are out of scope.

Researchers sign in with GitHub. Each report opens a draft GitHub Security Advisory, and the team says it responds within 96 hours. The bounty itself has no end date; only the reward boost ends on November 20.

Quick answers

Does it cost anything to submit?

Yes. Each submission needs a non refundable fee of 1 SOL, paid by burning SOL. Reports without the burn are not eligible.

How are rewards paid?

In USDC to a Solana wallet. KYC must be done within 30 days of the report being accepted.

What happens with duplicate reports?

The first reporter is paid, unless a later report shows higher impact.