Solana’s Alpenglow bug hunt charges researchers 0.5 SOL to report flaws
Anza is charging security researchers a non-refundable 0.5 SOL to file each Alpenglow finding before the competition closes at 16:00 UTC on Aug. 19.
The rules require every finding to pass through a designated portal, which burns the fee and creates one confidential GitHub Security Advisory. Reports sent through another channel are ineligible.
The target is consequential. SIMD-0326 proposes Alpenglow as a backwards-incompatible replacement for Solana's current Proof-of-History and TowerBFT consensus protocol. Anza has put the new consensus components, their validator integrations and the migration path inside the bounty's temporary scope.
Researchers pay the filing cost before Anza determines validity, severity, duplication or reward. They also work against a moving version of Agave master. Each report must identify the commit where the flaw appeared, reproduce the issue there and arrive while the bug remains unfixed on master.
A proof-of-concept requirement and the filing burn can reduce placeholder submissions. They can also price out a valid finding whose impact or priority is uncertain. The published rules contain no measure of participation or report quality that would settle the tradeoff.
The competition overview says Alpenglow was excluded from Agave's standing bounty during development, monorepo migration and internal-audit phases. The two-week competition opens an enumerated set of Alpenglow code that includes the Votor voting engine, vote and certificate messages, BLS signature and certificate verification, the TowerBFT migration path and specified validator integration surfaces.
Several boundaries remain. Public or previously disclosed issues do not qualify. Known issues, test code, third-party cryptography dependencies and ordinary TowerBFT-only paths are also excluded. Researchers must demonstrate findings on a local fork, multi-node harness or simulation; mainnet and public-testnet attacks are unauthorized.
Priority depends on evidence, not a timestamp alone. The earliest report that meets the proof-of-concept bar at Anza's assessed severity receives the award for that root cause. A placeholder reserves nothing. Later duplicates receive nothing unless one substantiates a strictly higher assessed severity.
Eligibility ends when a fix reaches Agave master. A report can therefore lose its chance of payment during the competition even when the researcher reproduced the flaw against an earlier in-window commit.
Under the Alpenglow rules, the advertised 50,000 SOL is the largest aggregate pool, unlocked only by the highest severity:
| Highest valid finding | Unlocked pool |
|---|---|
| DoS or Other | 10,000 SOL |
| Liveness or loss of availability | 20,000 SOL |
| Consensus or safety violation | 30,000 SOL |
| Loss of funds | 50,000 SOL |
Individual awards use smaller ranges. Loss-of-funds findings receive 6,250 to 25,000 SOL, consensus or safety violations 3,125 to 12,500 SOL, liveness findings 1,250 to 5,000 SOL, and DoS findings 315 to 1,250 SOL.
Anza reduces awards proportionally if the combined awards exceed the unlocked pool. Fewer or smaller findings can leave part of the pool unpaid. Even a loss-of-funds result unlocks the budget without raising any single award above 25,000 SOL.
Payment comes after the Sept. 2 adjudication close and KYC. Awards are lump sums in SOL locked for 12 months under the standing Agave bounty terms. The filing burn is immediate; compensation depends on later adjudication and remains illiquid for a year.
The Alpenglow bounty covers a consensus migration.
Alpenglow's Votor components use BLS-based vote and certificate aggregation and verification. Notarization, skip, finalization, and notar-fallback certificates require 60% of stake, while fast finalization requires 80%. The initial design keeps Turbine for data dissemination.
The proposal defines a 20+20 security model with 40% crash-failure resilience. It labels implementation risk as the main drawback, calls migration challenging, and states that the new voting logic is incompatible with its predecessor.
Anza included both core consensus crates and validator code that processes certificates, rewards and finalization state. The TowerBFT handoff is eligible too, putting the joins between old and new logic under review alongside Votor itself.
The official rules and overview still listed Aug. 19 as the cutoff when checked on Aug. 18, with no extension notice on either page. The submission window's close does not activate Alpenglow or complete the migration.
Confidentiality also separates the deadline from any public result. A finding stays private until its fix ships. Code awaiting mainnet activation can remain under embargo until the fix is merged and the relevant feature gate activates.
An empty public record after Aug. 19 would reveal nothing about the number of advisories. Before adjudication, the disclosed economics tell the story: 0.5 SOL leaves a researcher's wallet first, evidence determines priority, and only a substantiated loss-of-funds flaw opens the full pool.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

Galaxy Launches Bitcoin, Ethereum, and Solana Collateralized Lending Services

Jurassic Finance RAWR Completes B1 Disclosure, Dinosaur Fossil Token Structure Revealed

RockawayX Plans to Raise $150 Million to Establish Crypto Hedge Fund

Solana Surpasses Base with 518,400 x402 Transactions

Take-Two Reveals In-Game Currency Structure for Sharkbux

$1 Billion in 48 Hours: X Prepares Crypto Trading Function on Feed

Crypto: Solana ETFs Record Their Biggest Day of the Year

Bitcoin ETF Funds Attract $2.26 Billion in Six Days

Solana Reduces Slot Time to 350 Milliseconds, Aims for 200 Milliseconds

X Trade Buttons to Launch Soon, Bier Denies Crypto Shadowban

Push for Zcash ETF Listing, Solana AI Tokenization Begins

How Bitwise Funds Attracted $1.8 Billion in the First Half of the Year

Kylie Jenner Deletes Solana Meme Coin Post on X Account

Fidelity allows 100% crypto staking for ETFs with exit delay risks

Solana Fee Vote: Resource Charging Proposal Under Review

Solana stakers face yield cuts as a treasury firm fights to protect 99.4% of its revenue

SUI Enhances AI Wallet Functionality with Introduction of Squid Mode

Solana Prepares to Expand v1 Transaction Limit to 4096 Bytes

Solana DApp Revenue Reaches $35 Million, Hitting a 29-Week High

Virtuals Supports Agent Token Issuance on Solana

New Issuance of 250 Million USDC on Solana

Allegations of FOMO App Hacking Spark Controversy Over 662 SOL Transfer Records

Flowra launches Open Orderflow Auction for Solana validators

Solana Burn Surges to 87,000 SOL: Does This Change Token Scarcity?

Solana RWA Total Value Reaches $4 Billion, Number of Holders Surpasses 350,000

Solana Network REV Surpasses $1 Million, Reaches Six-Month High

Stablecoin Card Recharge Amount Increases by 38% in One Year, Reaching $13.8 Billion

Shinhan Financial Group Partners with Solana for KRW Tokenized Fund Verification

Phantom ends Sui support on Sept. 24










