Firedancer opens its own bug bounty platform, double rewards through 20 November
Firedancer has opened bounty.firedancer.io. Through 20 November, rewards are doubled, and tripled for Alpenglow. The blog reviews the Immunefi contest from 9 April to 9 May.
Own platform
Firedancer opened its own bug bounty platform on 16 October, at bounty.firedancer.io. Firedancer announced it on X. Ishan Bhatt of Jump Crypto wrote the blog post “Hardening Firedancer.”
Through 20 November, every finding pays double, and Alpenglow findings pay triple. The post and the platform state that date and those multipliers. The blog describes the coming month as double rewards and Alpenglow findings as triple.
Firedancer is an independent validator client for Solana. The blog says Firedancer secures 15 percent of stake at the time of writing. The mainnet date is in the epoch 1064 report. Release v26.10.2 and the limit during the switch are in the release report.
Immunefi contest
The blog reviews a contest that ran on Immunefi from 9 April to 9 May. The prize pool was $1 million. Over 30 days, 162 researchers filed 809 reports.
Of those, 127 were unique security findings. The blog leaves out the Insight category: performance notes and bugs that cannot be exploited. Nearly half of the valid submissions were duplicates.
The pool rose with the highest severity found:
- $100,000 at the floor
- $250,000 once a medium landed
- $500,000 for a high
- $1 million for a critical
Each submission carried a $100 fee. Each researcher could file one report a day. The Frankendancer contest ran two weeks longer and drew about one twentieth of this volume.
Longer reports, new rules
The team writes that an AI agent found or wrote nearly every submission. That is the blog’s judgment. Reports also got longer.
Leaving out formatting and code, the average report was 1,064 words. With everything included, it was 2,610. Before 2025, reports to their own programs averaged 406 words.
The new platform requires a burn of 1 SOL on each submission, according to the blog. The site says the payment is irreversible and is not refunded. It goes to an incinerator address.
The blog caps each section at 3,000 characters. On the form, that cap applies to the description, the steps, the impact, and the proof of concept. The summary stops at 1,024 characters.
Scheduling bug
The blog describes a high-severity bug in how Firedancer schedules transactions. Firedancer could run the transactions in a block in a different order from other clients. Validators would then vote on different results.
The team calls that a consensus divergence. A remote attacker could have triggered the bug, the blog says. It did not count as critical, because the attack was not precise enough to cause predictable, serious harm.
What to watch
- What the new platform pays at each severity
- Whether a release closes the scheduling bug the blog describes
- Whether Firedancer still secures 15 percent of stake after the post
Sources
- Firedancer — Post, 16 October 2026, 7:37 p.m. Berlin
- Jump Crypto, Ishan Bhatt — Blog “Hardening Firedancer,” 16 October 2026
- Firedancer — Bug bounty platform, read 16 October 2026
- SOLANA·HUB — Alpenglow, epoch 1064
- SOLANA·HUB — Firedancer v26.10.2