The spring contest allowed eligible duplicates to earn rewards, while Bhatt's retrospective links repeated discoveries partly to slow review.

Firedancer, Jump Crypto's independent validator software for Solana, requires researchers to burn 1 SOL to qualify for a bug bounty under terms effective Oct. 18. The burn is non-refundable even when a report identifies a real vulnerability that someone else submitted first.

The change narrows the route to payment for later finders compared with Firedancer's spring audit contest. In an Oct. 16 retrospective for Jump Crypto, Ishan Bhatt partly attributes the duplicate-report problem to the team's own review delays: researchers kept finding bugs while earlier reports waited for action.

The current terms generally award the first submission about the same issue or a similar variant, while preserving discretionary rewards for some later reports.

Firedancer's earlier Immunefi contest ran April 9–May 9, 2026. Its published rules explicitly made duplicate reports of an unfixed bug eligible for rewards. Once a fix was publicly disclosed, new reports became invalid, while reports submitted before the fix remained eligible.

That was already a paid submission system. In his Oct. 16 Hardening Firedancer retrospective, Bhatt says the contest charged $100 per report and imposed a limit of one submission per researcher a day. The October development is a different fee structure paired with narrower duplicate eligibility.

A later researcher may earn a reward by demonstrating greater impact or a wider affected surface. An incomplete first submission, or one resting on incorrect assumptions, may allow a later report to become the chief finding.

Source link