Solana’s Alpenglow bug hunt charges researchers 0.5 SOL to report flaws

Anza is charging security researchers a non-refundable 0.5 $SOL to file each Alpenglow finding before the competition closes at 16:00 UTC on Aug. 19.

The rules require every finding to pass through a designated portal, which burns the fee and creates one confidential GitHub Security Advisory. Reports sent through another channel are ineligible.

The target is consequential. SIMD-0326 proposes Alpenglow as a backwards-incompatible replacement for Solana’s current Proof-of-History and TowerBFT consensus protocol. Anza has put the new consensus components, their validator integrations and the migration path inside the bounty’s temporary scope.

Researchers pay the filing cost before Anza determines validity, severity, duplication or reward. They also work against a moving version of Agave master. Each report must identify the commit where the flaw appeared, reproduce the issue there and arrive while the bug remains unfixed on master.

A proof-of-concept requirement and the filing burn can reduce placeholder submissions. They can also price out a valid finding whose impact or priority is uncertain. The published rules contain no measure of participation or report quality that would settle the tradeoff.

Researchers pay before eligibility is settled

The competition overview says Alpenglow was excluded from Agave’s standing bounty during development, monorepo migration and internal-audit phases. The two-week competition opens an enumerated set of Alpenglow code that includes the Votor voting engine, vote and certificate messages, BLS signature and certificate verification, the TowerBFT migration path and specified validator integration surfaces.

Several boundaries remain. Public or previously disclosed issues do not qualify. Known issues, test code, third-party cryptography dependencies and ordinary TowerBFT-only paths are also excluded. Researchers must demonstrate findings on a local fork, multi-node harness or simulation; mainnet and public-testnet attacks are unauthorized.

Priority depends on evidence, not a timestamp alone. The earliest report that meets the proof-of-concept bar at Anza’s assessed severity receives the award for that root cause. A placeholder reserves nothing. Later duplicates receive nothing unless one substantiates a strictly higher assessed severity.

Eligibility ends when a fix reaches Agave master. A report can therefore lose its chance of payment during the competition even when the researcher reproduced the flaw against an earlier in-window commit.

Under the Alpenglow rules, the advertised 50,000 $SOL is the largest aggregate pool, unlocked only by the highest severity:

Individual awards use smaller ranges. Loss-of-funds findings receive 6,250 to 25,000 $SOL, consensus or safety violations 3,125 to 12,500 $SOL, liveness findings 1,250 to 5,000 $SOL, and DoS findings 315 to 1,250 $SOL.

Anza reduces awards proportionally if the combined awards exceed the unlocked pool. Fewer or smaller findings can leave part of the pool unpaid. Even a loss-of-funds result unlocks the budget without raising any single award above 25,000 $SOL.

Payment comes after the Sept. 2 adjudication close and KYC. Awards are lump sums in $SOL locked for 12 months under the standing Agave bounty terms. The filing burn is immediate; compensation depends on later adjudication and remains illiquid for a year.

The Alpenglow bounty covers a consensus migration

Alpenglow’s Votor components use BLS-based vote and certificate aggregation and verification. Notarization, skip, finalization, and notar-fallback certificates require 60% of stake, while fast finalization requires 80%. The initial design keeps Turbine for data dissemination.

The proposal defines a 20+20 security model with 40% crash-failure resilience. It labels implementation risk as the main drawback, calls migration challenging, and states that the new voting logic is incompatible with its predecessor.

Anza included both core consensus crates and validator code that processes certificates, rewards and finalization state. The TowerBFT handoff is eligible too, putting the joins between old and new logic under review alongside Votor itself.

The official rules and overview still listed Aug. 19 as the cutoff when checked on Aug. 18, with no extension notice on either page. The submission window’s close does not activate Alpenglow or complete the migration.

Confidentiality also separates the deadline from any public result. A finding stays private until its fix ships. Code awaiting mainnet activation can remain under embargo until the fix is merged and the relevant feature gate activates.

An empty public record after Aug. 19 would reveal nothing about the number of advisories. Before adjudication, the disclosed economics tell the story: 0.5 $SOL leaves a researcher’s wallet first, evidence determines priority, and only a substantiated loss-of-funds flaw opens the full pool.