Jump Crypto has launched a bug bounty for its Firedancer validator that charges researchers a non-refundable fee for every report, after a $1m contest left its team buried in what it believes were almost entirely AI-generated submissions. The fee is a crypto mechanism, but the triage problem behind it is one every UK bounty and disclosure programme owner now faces.
What happened
On 16 October 2026 Jump Crypto opened a self-hosted bug bounty platform for Firedancer, its independent validator client for the Solana blockchain. Until 20 November every valid report earns double the standard reward, and findings tied to Alpenglow, a consensus upgrade due on Solana’s main network on 21 October, earn triple. The published terms give a guideline of $50,000 to $100,000 for a Critical finding, though payouts are at the team’s discretion, so the boosted ceiling for an Alpenglow critical reaches $300,000.
The detail that matters beyond crypto is the price of entry. Each submission requires the researcher to burn 1 SOL, destroying the tokens so nobody receives the money, and the fee is not refunded for duplicates, invalid or out-of-scope reports. Report sections are capped at 3,000 characters each.
Jump explained why in a postmortem, “Hardening Firedancer”, published the same day. Its $1m public audit contest, hosted on Immunefi for a month from 9 April, drew 809 reports from 162 researchers. Once low-value “insight” items were stripped out, 127 unique security findings remained, and almost half of the valid submissions duplicated something already reported. Jump says that is about twenty times the volume of its 2024 Frankendancer contest, which ran a fortnight longer.
The detail
Jump expected a fairly even split between human and AI-assisted work; it now believes almost every report was found or drafted by an agent. Reports averaged 1,064 words excluding code and formatting, and 2,610 words in total, against an average of 406 words for submissions to its programmes before 2025.
Agents running similar models tended to land on the same bugs, so each genuine discovery was followed by a wave of near-identical reports. Because triage fell behind, fixes and disclosures lagged, and other agents kept rediscovering the same open issues. Jump says around four in five duplicates landed more than three days after the original, with roughly 26 reports a day coming in and an open queue that peaked at 299.
Jump says agents were strong at spotting where Firedancer departed from Agave, the other main Solana client, or broke a documented rule, but weak on unwritten assumptions, which drove most false positives. The worst bug it describes, rated High, could have made Firedancer nodes run a block in the wrong order and split from the network.
The contest had already charged $100 per report and allowed one submission per researcher a day. Jump concluded the fee did not deter serious hunters, hence the 1 SOL burn now, alongside length limits, better-documented invariants and an automated first pass over every report. On that last point, Jump says it “never saw an LLM discard a valid finding”.
Why it matters for UK organisations
Few British organisations run Solana validators; the relevance lies in the operating model. Jump’s numbers are some of the clearest public data yet on what AI-driven submission volumes do to a reward programme, and they arrive weeks after Google closed its Open Source Software VRP to product flaw reports from 1 October, blaming a surge of automated reports, “the vast majority of which are not valid”.
UK organisations that run a public bounty, or simply publish a vulnerability disclosure policy and a security.txt file, should expect the same pressure. An inbox sized for a few thoughtful emails a month will not cope with dozens of polished, confident and often wrong reports. A real finding buried in a backlog of 300 reports goes unfixed, and the Firedancer data shows that delay breeds yet more duplicates.
A fee is not a direct template, though. A paid bounty can reasonably ask hunters to put something at stake. A VDP exists to make it easy for anyone to tell you about a problem, often with no reward at all, and charging for that would discourage exactly the good-faith reporters you want. UK researchers also still work without a statutory defence under the Computer Misuse Act 1990. In September the government rejected an amendment to the Cyber Security and Resilience Bill that would have required a review of such a defence, saying changes would come “as soon as parliamentary time allows”. Adding cost on top of legal uncertainty is a hard sell.
Expert view
In my experience the bottleneck in any disclosure process has always been the person reading the report, not the person writing it. AI has made writing almost free. What Jump has done is put a small price back on volume, and paired it with things that cut reading time: hard length caps, a fixed structure and a machine triage pass.
The fee is the headline, but the other levers matter more. Writing down your system’s assumptions, so that both humans and agents stop flagging behaviour that is intended, is cheap and works for any programme. So is triaging quickly enough that the first report of a bug is fixed and closed before the copycats arrive. When we review client estates, the commonest disclosure failure is not a missing policy but an unmonitored mailbox.
A non-refundable fee hits the first-time hunter who misjudges scope harder than an established team, and Jump’s terms leave severity and payout largely to its own discretion, with legal protection limited to a promise not to pursue researchers acting in good faith. Programme owners copying the model need clear scope and quick, honest decisions, or the fee will simply look like a charge for being ignored.
What to do now
- Measure your intake. Track weekly report volume, average length, duplicate rate and time to first response for your bounty or VDP. A sudden rise in long, generic reports is your early warning.
- Add an automated first pass. Use an LLM to summarise each report and flag obvious junk, but keep a human decision on anything that is not clearly invalid.
- Impose structure and length limits. Require a short summary, affected asset, reproduction steps and impact in fixed fields.
- Publish your assumptions. Document trust boundaries, intended behaviour and known issues in your scope page, so automated hunters stop reporting design choices.
- Close fast to cut duplicates. Fix, acknowledge and where appropriate disclose validated issues promptly. This also supports the Cyber Essentials security update management control, since a finding left in a queue is effectively an unpatched vulnerability.
- Use friction only where rewards exist. If you run a paid bounty, consider rate limits, reputation thresholds or deposits for new accounts. Keep your free VDP route open and simple, with clear safe harbour wording.
Bottom line
Jump’s 1 SOL burn is a crypto-native answer to a problem that is not specific to crypto: AI has made vulnerability reports cheap to produce and expensive to judge. UK programme owners do not need a token burn, but they do need to plan for higher volume, faster triage and better-documented scope before their own inbox reaches 299 open reports.
Sources
- Jump Crypto: Hardening Firedancer
- Firedancer: Bug Bounty Terms & Conditions
- Solana Compass: Firedancer Bug Bounty Platform Goes Live With 3x Rewards for Alpenglow Findings After Jump’s $1M Audit Contest
- TokenPost: Firedancer Offers Double Bug Bounty Rewards Through Nov. 20
- Help Net Security: AI slop submissions force Google to freeze its open-source bug bounty
- Computer Weekly: Government rejects Computer Misuse Act amendment to protect cyber professionals
