Firedancer makes bounty hunters burn 1 SOL even for duplicate bug reports

Firedancer, Jump Crypto's independent validator software for Solana, requires researchers to burn 1 SOL to qualify for a bug bounty under terms effective Oct. 18. The burn is non-refundable even when a report identifies a real vulnerability that someone else submitted first.The change narrows the route to payment for later finders compared with Firedancer's spring audit contest. In an Oct. 16 retrospective for Jump Crypto, Ishan Bhatt partly attributes the duplicate-report problem to the team's own review delays: researchers kept finding bugs while earlier reports waited for action.The current terms generally award the first submission about the same issue or a similar variant, while preserving discretionary rewards for some later reports.A real bug can still leave its finder out of pocketFiredancer's earlier Immunefi contest ran April 9–May 9, 2026. Its published rules explicitly made duplicate reports of an unfixed bug eligible for rewards. Once a fix was publicly disclosed, new reports became invalid, while reports submitted before the fix remained eligible.That was already a paid submission system. In his Oct. 16 Hardening Firedancer retrospective, Bhatt says the contest charge...