Solana’s Alpenglow bug hunt charges researchers 0.5 SOL to report flaws

Anza is charging security researchers a non-refundable 0.5 SOL to file each Alpenglow finding before the competition closes at 16:00 UTC on Aug. 19.

The rules require every finding to pass through a designated portal, which burns the fee and creates one confidential GitHub Security Advisory. Reports sent through another channel are ineligible.

The target is consequential. SIMD-0326 proposes Alpenglow as a backwards-incompatible replacement for Solana’s current Proof-of-History and TowerBFT consensus protocol. Anza has put the new consensus components, their validator integrations and the migration path inside the bounty’s temporary scope.

Related Reading

Solana validators approve Alpenglow upgrade, positioning SOL for a run to $250

The protocol transformation promises to slash transaction finality from TowerBFT's current 12.8 seconds to as low as 100-150 milliseconds.

Sep 2, 2025 · Gino Matos

Researchers pay the filing cost before Anza determines validity, severity, duplication or reward. They also work against a moving version of Agave master. Each report must identify the commit where the flaw appeared, reproduce the issue there and arrive while the bug remains unfixed on master.

A proof-of-concept requirement and the filing burn can reduce placeholder submissions. They can also price out a valid finding whose impact or priority is uncertain. The published rules contain no measure of participation or report quality that would settle the tradeoff.

Researchers pay before eligibility is settled

The competition overview says Alpenglow was excluded from Agave’s standing bounty during development, monorepo migration and internal-audit phases. The two-week competition opens an enumerated set of Alpenglow code that includes the Votor voting engine, vote and certificate messages, BLS signature and certificate verification, the TowerBFT migration path and specified validator integration surfaces.

Several boundaries remain. Public or previously disclosed issues do not qualify. Known issues, test code, third-party cryptography dependencies and ordinary TowerBFT-only paths are also excluded. Researchers must demonstrate findings on a local fork, multi-node harness or simulation; mainnet and public-testnet attacks are unauthorized.

Related Reading

Solana just absorbed a historic DDoS attack, and the silence tells investors everything they need to know

While the market panicked over price drops, the network faced a Google-scale assault without a single second of downtime, proving the "outage meme" may finally be dead.

Dec 16, 2025 · Oluwapelumi Adejumo

Priority depends on evidence, not a timestamp alone. The earliest report that meets the proof-of-concept bar at Anza’s assessed severity receives the award for that root cause. A placeholder reserves nothing. Later duplicates receive nothing unless one substantiates a strictly higher assessed severity.

Eligibility ends when a fix reaches Agave master. A report can therefore lose its chance of payment during the competition even when the researcher reproduced the flaw against an earlier in-window commit.

Under the Alpenglow rules, the advertised 50,000 SOL is the largest aggregate pool, unlocked only by the highest severity:

Individual awards use smaller ranges. Loss-of-funds findings receive 6,250 to 25,000 SOL, consensus or safety violations 3,125 to 12,500 SOL, liveness findings 1,250 to 5,000 SOL, and DoS findings 315 to 1,250 SOL.

Anza reduces awards proportionally if the combined awards exceed the unlocked pool. Fewer or smaller findings can leave part of the pool unpaid. Even a loss-of-funds result unlocks the budget without raising any single award above 25,000 SOL.

Payment comes after the Sept. 2 adjudication close and KYC. Awards are lump sums in SOL locked for 12 months under the standing Agave bounty terms. The filing burn is immediate; compensation depends on later adjudication and remains illiquid for a year.

The Alpenglow bounty covers a consensus migration

Alpenglow’s Votor components use BLS-based vote and certificate aggregation and verification. Notarization, skip, finalization, and notar-fallback certificates require 60% of stake, while fast finalization requires 80%. The initial design keeps Turbine for data dissemination.

The proposal defines a 20+20 security model with 40% crash-failure resilience. It labels implementation risk as the main drawback, calls migration challenging, and states that the new voting logic is incompatible with its predecessor.

Anza included both core consensus crates and validator code that processes certificates, rewards and finalization state. The TowerBFT handoff is eligible too, putting the joins between old and new logic under review alongside Votor itself.

The official rules and overview still listed Aug. 19 as the cutoff when checked on Aug. 18, with no extension notice on either page. The submission window’s close does not activate Alpenglow or complete the migration.

Confidentiality also separates the deadline from any public result. A finding stays private until its fix ships. Code awaiting mainnet activation can remain under embargo until the fix is merged and the relevant feature gate activates.

An empty public record after Aug. 19 would reveal nothing about the number of advisories. Before adjudication, the disclosed economics tell the story: 0.5 SOL leaves a researcher’s wallet first, evidence determines priority, and only a substantiated loss-of-funds flaw opens the full pool.