Solana Mobile Formalizes Security: Bug Bounty for the Seed Vault, Up to $75,000

What Happened

Solana Mobile has formalized three security building blocks: a vulnerability disclosure policy (with safe-harbor rules for reporters), a bug bounty program, and security grants for research teams — EthelSec is named as the first team.

The bounty scope hits the heart of the device:

• Seed Vault — the Seeker’s hardware-backed key storage: the TEE environment (trusted execution environment), the Android system service, and the seed/wallet UI, including signing flows.
• SKR on-chain programs — the Seeker token’s inflation and staking.
• Seeker Genesis token infrastructure.

Rewards are tiered by impact, up to $75,000, paid in SKR via award agreements with vesting and usage conditions.

Why It Matters

The Seed Vault is the Seeker’s security promise: private keys live in secured hardware, not in an app. Exactly that layer now gets formal incentives for external reviewers — the usual maturation step that protocols like Alpenglow with its running bounty competition are currently demonstrating, now at the device level. It fits the line the Solana Foundation’s CISO recently drew: structural protection layers rather than awareness alone.

For Seeker owners, nothing changes directly — the program targets security researchers. Indirectly it concerns them immediately: their device’s key storage is now being tested systematically and with formal incentives.

Note: This is reporting, not investment advice.

What to Watch

• Which findings from bounty and grants get publicly documented
• Whether the scope grows beyond Seed Vault and the SKR programs
• How quickly reported vulnerabilities get fixed and disclosed

Sources

• Solana Mobile — Blog: VDP, bug bounty, and security grants · Announcement on X
• SOLANA·HUB news: Alpenglow bug bounty · CISO interview
• SOLANA·HUB knowledge: Solana Wallet Security