Solana’s Alpenglow bug hunt charges researchers 0.5 SOL to report flaws
Anza’s Alpenglow bug bounty requires researchers to submit each finding through a designated portal and pay a non-refundable 0.5 SOL filing fee, which burns on submission. Only reports filed this way are eligible; other channels do not count. The competition runs until 16:00 UTC on Aug. 19, with adjudication closing Sept. 2 after KYC. Findings must be reproducible on a local fork, harness, or simulation against a specific Agave master commit and must still be unfixed when submitted. Scope covers the new Alpenglow consensus code: Votor, BLS vote/certificate verification, validator integration, and the TowerBFT migration path. Public, known, test, third-party crypto, and ordinary TowerBFT-only issues are excluded. Payouts depend on assessed severity, not submission time: loss-of-funds 6,250–25,000 SOL, consensus/safety 3,125–12,500, liveness 1,250–5,000, DoS 315–1,250. The advertised pool is 50,000 SOL, but awards are reduced if needed. Findings stay private until fixed, and payouts are locked for 12 months.
