Solana’s Firedancer developers have introduced a mandatory 1 SOL burn for every security bug submission after an audit competition received 809 reports, many of which were suspected to have been created or assisted by artificial intelligence.

The fee, worth around $100 at current prices, is designed to discourage spam and reduce the time engineers spend evaluating duplicate or invalid findings. Under the rules updated Monday, researchers cannot recover the payment if their reports are rejected, fall outside the program’s scope, or duplicate existing findings. Reports submitted without burning the required SOL will not qualify for rewards.

Jump Crypto developed Firedancer as an alternative to Agave, the primary software client used by Solana validators to verify transactions and maintain network operations.

Security flaws in validator software can interrupt transaction processing or cause different validators to reach conflicting conclusions about account balances and network state. An influx of low-quality reports can delay investigations into vulnerabilities that pose genuine risks.

AI-Assisted Bug Reports Create a Growing Backlog

The revised policy follows a $1 million security audit contest that ran from April 9 to May 9. A total of 162 researchers submitted 809 reports, producing 127 distinct security findings after non-exploitable observations were excluded. Nearly half of the valid submissions duplicated previously reported issues.

Jump suspects that AI agents helped discover or write almost all the submissions.

In an Oct. 16 review, Jump’s Ishan Bhatt noted that while AI has reduced the cost of finding potential bugs, verifying them remains expensive.

Engineers must reproduce each reported issue and establish whether the proposed exploit can actually work. Some submissions pointed to apparent weaknesses but overlooked safeguards implemented elsewhere in the software.

The review queue peaked at 299 outstanding reports. Delays meant additional researchers sometimes submitted vulnerabilities that were already under investigation but had not yet been fixed or publicly disclosed. Roughly 80% of duplicate reports arrived more than three days after the initial submission.

The competition had already imposed a $100 reporting fee and restricted participants to one submission per day. Jump said these measures were intended to discourage researchers from flooding the program with speculative findings that require extensive verification.

The company has also capped each main section of a bug report at 3,000 characters to encourage shorter, more focused submissions.

Higher Rewards Target Serious Vulnerabilities

Despite the volume of low-quality reports, the competition uncovered significant security weaknesses. One involved a transaction scheduling error that could cause Firedancer to process transactions in the wrong sequence, potentially creating disagreements between its validators and other Solana validators about the network’s state.

Jump is increasing bounty payments alongside the new submission requirement to maintain incentives for researchers who identify meaningful security issues.

Qualifying findings will receive twice the standard reward through Nov. 20. Vulnerabilities specific to Alpenglow, Solana’s new voting system, will qualify for three times the usual payout, with rewards for critical issues reaching as much as $300,000.

The updated rules underscore a growing problem for blockchain security programs: AI tools can generate potential bug reports at scale, but distinguishing genuine, exploitable vulnerabilities from duplicates and false alarms still demands substantial engineering resources.