Anza Opens Alpenglow Bug Bounty — a Security Step Before Mainnet
Anza has opened the bug bounty repository for Alpenglow — the new Solana consensus that replaces TowerBFT. Submissions aren't open yet, scope and rewards to follow. A hardening step ahead of the targeted mainnet rollout.
What happened
Anza has opened the bug bounty repository for Alpenglow on GitHub — the new consensus mechanism meant to replace Solana’s current TowerBFT and Proof-of-History. Submissions are not open yet, though: per the repository, “Submissions are not open yet,” and “Full scope, rules, dates, and rewards are coming soon.” The move marks the transition into the security and audit phase — the usual path before a mainnet rollout.
What is in scope
The focus is on the Alpenglow logic currently being migrated into the Agave client. The bounty repository names as core modules, among others, votor (the voting engine), votor-messages, and BLS signature verification (bls-sigverify, bls-cert-verify). These building blocks are the heart of Alpenglow’s finalization — bugs here would have immediate consequences for the security of consensus.
What Alpenglow is for
Alpenglow replaces two core components: Votor handles voting and finalization, Rotor handles data distribution. Per simulation, block finality drops from roughly 12.8 seconds to about 150 milliseconds — one of the largest latency improvements since mainnet launch. The network stays functional as long as no more than 20 percent of stake is adversarial and 20 percent unresponsive. Our background piece has the technical depth: Alpenglow: Solana’s new consensus explained.
Context
- A bug bounty is a security milestone, not a release. It shows Alpenglow moving from pure testing into pre-mainnet hardening — but “coming soon” means dates and rewards are still pending.
- Alpenglow has been running on a community test cluster since May; in parallel, Agave v4.1 prepared validators. A mainnet rollout is targeted for Q3 2026 — there is no fixed date.
- The pattern is established: the Firedancer client, too, went through a public bug bounty before its mainnet deployment. Security before speed, especially at the heart of the network.
Note: This is reporting, not investment advice.
What to watch
- When submissions open and what scope and rewards the program names
- Whether the Q3 2026 mainnet target holds
- How quickly the migration of Alpenglow logic into the Agave master completes