Software teams once treated a surge in vulnerability reports as an unqualified success. Firedancer’s latest bounty rules show why that assumption is breaking. Effective 26 October, anyone seeking a reward for reporting a flaw in the Solana validator client must permanently burn 1 SOL with the submission. The fee is not returned when the report is a duplicate, invalid or outside scope. bounty.firedancer.io
The policy is an economic filter for a new security problem: artificial intelligence can produce candidate findings and polished reports faster than expert reviewers can validate them. The scarce resource is no longer the first-pass search for suspicious code. It is the human time needed to reproduce a claim, establish exploitability, separate duplicates, judge severity and coordinate a safe fix.
Firedancer’s audit produced volume, not proportional signal
Jump Crypto’s Firedancer security retrospective gives the clearest public measurement of the shift. Its 30-day contest, held from 9 April to 9 May, received 809 reports from 162 researchers. Those reports produced 127 unique, non-insight security submissions. Nearly half of the valid submissions were duplicates, and the submission count was roughly 20 times the volume of an earlier Frankendancer contest that ran two weeks longer. jumpcrypto.com
Jump says it believes nearly every submission was either discovered or written with an AI agent. That attribution cannot be independently verified from the published data, and the company acknowledges that it cannot know which bugs agents failed to find. The report volume and duplication rate are established facts. The proportion involving AI is Jump’s assessment, not a chain-verifiable measurement. jumpcrypto.com
The contest already charged $100 per report and limited each researcher to one submission a day. The permanent Firedancer bounty terms now use a native-asset burn instead. At the scan price near $100 per SOL, the filter has a similar immediate cost, but its crypto-native design makes the expense transparent and irreversible. The program promises an initial response within 96 hours and temporarily doubles standard payouts through 20 November, with triple payouts for Alpenglow-specific findings. Critical reports carry standard guidance of $50,000 to $100,000, rising as high as $300,000 for an Alpenglow-specific finding during the boost. bounty.firedancer.io
Bitcoin Core chose speed instead of a price filter
Bitcoin Core is responding to the same pressure with a different control. In an October 22 policy update, maintainer Antoine Poinsot said reports of easily rediscovered vulnerabilities had increased, largely because language models lowered the discovery threshold. Bitcoin Core may now classify such a bug during triage, backport the fix to all maintained releases, ship releases as soon as practical and publish an advisory with them. mirror.b10c.me
The revised Bitcoin Core security policy shortens secrecy where secrecy no longer buys meaningful protection. Bitcoin’s historically slow upgrade culture made long embargoes useful for difficult discoveries, but a flaw recoverable with a simple model prompt may already be within reach of attackers. In that case, delaying the fixed release can leave users exposed without preserving much informational advantage.
These responses are complementary, not contradictory. Firedancer is trying to reduce low-quality inbound work before it consumes reviewer capacity. Bitcoin Core is reducing the time between validation and public remediation for a class of flaws whose rediscovery risk has risen. Both policies price the same bottleneck: trustworthy expert judgment.
The model also carries risks. A submission fee can deter independent researchers in lower-income regions or discourage uncertain but important reports. Faster disclosure can expose slow-upgrading operators. AI-generated noise can still hide a serious finding inside a weak explanation. Bounty programs will need appeal paths, reproducible proof requirements and performance data showing whether filters improve precision without suppressing valuable research.
TOKEN RECON ASSESSMENT
AI has not automated crypto security. It has automated enough of the search and report-writing process to make triage economics a protocol risk. Firedancer’s one-SOL burn is a testable intervention: if report volume and duplicate rates fall while validated high-severity discoveries hold steady, the fee will look like useful spam pricing. If credible researchers stop submitting or serious findings arrive through private side channels, the filter will have shifted risk rather than reduced it. Bitcoin Core’s faster remediation policy creates a second measurable test, the interval between triage, patched releases and operator adoption for easy-to-rediscover bugs. Those outcomes, not submission totals, will show whether the industry is converting cheaper discovery into safer software.
Sources
Firedancer bug bounty terms, effective 26 October 2026
Jump Crypto, Hardening Firedancer
CoinDesk, Firedancer adds a one-SOL report burn
Bitcoin Development Mailing List, Bitcoin Core security policy update
