Solana’s Alpenglow bug hunt charges researchers 0.5 SOL to report flaws
Anza is charging security researchers a non-refundable 0.5 SOL to file each Alpenglow finding before the competition closes at 16:00 UTC on Aug. 19.
The rules require every finding to pass through a designated portal, which burns the fee and creates one confidential GitHub Security Advisory. Reports sent through another channel are ineligible.
The target is consequential. SIMD-0326 proposes Alpenglow as a backwards-incompatible replacement for Solana's current Proof-of-History and TowerBFT consensus protocol. Anza has put the new consensus components, their validator integrations and the migration path inside the bounty's temporary scope.
Researchers pay the filing cost before Anza determines validity, severity, duplication or reward. They also work against a moving version of Agave master. Each report must identify the commit where the flaw appeared, reproduce the issue there and arrive while the bug remains unfixed on master.
A proof-of-concept requirement and the filing burn can reduce placeholder submissions. They can also price out a valid finding whose impact or priority is uncertain. The published rules contain no measure of participation or report quality that would settle the tradeoff.
The competition overview says Alpenglow was excluded from Agave's standing bounty during development, monorepo migration and internal-audit phases. The two-week competition opens an enumerated set of Alpenglow code that includes the Votor voting engine, vote and certificate messages, BLS signature and certificate verification, the TowerBFT migration path and specified validator integration surfaces.
Several boundaries remain. Public or previously disclosed issues do not qualify. Known issues, test code, third-party cryptography dependencies and ordinary TowerBFT-only paths are also excluded. Researchers must demonstrate findings on a local fork, multi-node harness or simulation; mainnet and public-testnet attacks are unauthorized.
Priority depends on evidence, not a timestamp alone. The earliest report that meets the proof-of-concept bar at Anza's assessed severity receives the award for that root cause. A placeholder reserves nothing. Later duplicates receive nothing unless one substantiates a strictly higher assessed severity.
Eligibility ends when a fix reaches Agave master. A report can therefore lose its chance of payment during the competition even when the researcher reproduced the flaw against an earlier in-window commit.
Under the Alpenglow rules, the advertised 50,000 SOL is the largest aggregate pool, unlocked only by the highest severity:
| Highest valid finding | Unlocked pool |
|---|---|
| DoS or Other | 10,000 SOL |
| Liveness or loss of availability | 20,000 SOL |
| Consensus or safety violation | 30,000 SOL |
| Loss of funds | 50,000 SOL |
Individual awards use smaller ranges. Loss-of-funds findings receive 6,250 to 25,000 SOL, consensus or safety violations 3,125 to 12,500 SOL, liveness findings 1,250 to 5,000 SOL, and DoS findings 315 to 1,250 SOL.
Anza reduces awards proportionally if the combined awards exceed the unlocked pool. Fewer or smaller findings can leave part of the pool unpaid. Even a loss-of-funds result unlocks the budget without raising any single award above 25,000 SOL.
Payment comes after the Sept. 2 adjudication close and KYC. Awards are lump sums in SOL locked for 12 months under the standing Agave bounty terms. The filing burn is immediate; compensation depends on later adjudication and remains illiquid for a year.
The Alpenglow bounty covers a consensus migration.
Alpenglow's Votor components use BLS-based vote and certificate aggregation and verification. Notarization, skip, finalization, and notar-fallback certificates require 60% of stake, while fast finalization requires 80%. The initial design keeps Turbine for data dissemination.
The proposal defines a 20+20 security model with 40% crash-failure resilience. It labels implementation risk as the main drawback, calls migration challenging, and states that the new voting logic is incompatible with its predecessor.
Anza included both core consensus crates and validator code that processes certificates, rewards and finalization state. The TowerBFT handoff is eligible too, putting the joins between old and new logic under review alongside Votor itself.
The official rules and overview still listed Aug. 19 as the cutoff when checked on Aug. 18, with no extension notice on either page. The submission window's close does not activate Alpenglow or complete the migration.
Confidentiality also separates the deadline from any public result. A finding stays private until its fix ships. Code awaiting mainnet activation can remain under embargo until the fix is merged and the relevant feature gate activates.
An empty public record after Aug. 19 would reveal nothing about the number of advisories. Before adjudication, the disclosed economics tell the story: 0.5 SOL leaves a researcher's wallet first, evidence determines priority, and only a substantiated loss-of-funds flaw opens the full pool.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

Solana Rent Reduced to 5080 Lamports, Effective September 11

Geo-DePIN Project TINA Completes $3 Million Financing

Anchorage Digital opens institutional access to Frgmnt’s fUSD and sfUSD

Bonk Guy Clarifies Buying EMBER Is Not a Challenge to STONK

Solana Alpen Glow Feature Activation Scheduled for September 28, 2026
![[Full Text] Solana Foundation: "Korean STOs Should Start Within Regulations and Expand Globally"](/public-static/10_5acc261b9b.png?format=avif)
[Full Text] Solana Foundation: "Korean STOs Should Start Within Regulations and Expand Globally"

Bitget Wallet joins BCCC to take part in Japan’s self custody debate

Solana DEX Trading Volume Reaches $2.948 Billion, Ranking First

Solana Breaks Records, But Its Daily Revenues Make the Difference

Coinbase Wallet Rebrands, Shifts Focus to Multichain Trading

Cosmos says bank tokenization is moving beyond pilots

How Will Apple's New Product Launch Event Impact AAPL Stock and Stock Tokens?

ProfitX Sports Prediction Market Launches Solana API

Canada's XRP ETF Options Provide Regulated Access to the U.S.

Outflow from Bitcoin Funds, Growth for Ethereum and Solana

BSOL Cumulative Net Inflow Reaches $1.033 Billion, $10.74 Million as Net Inflow

The Netherlands Plays a Major Role in the Solana Network with 19.6 Percent of Transactions

Coinbase expands AI access to stocks and crypto

Activation of Solana Beta Mainnet Transaction V1 Delayed to Epoch 1035

SOL Spot ETF Sees Daily Net Inflow of $11.73 Million

Solana's RWA Trading Volume Reaches $14.7 Billion, 12% Market Cap Share

Stablecoin Supply Nears $290 Billion, Annual Transactions Exceed $90 Trillion

Solana Adds 20 Tokenized Stocks Including Nike and Micron

Solana’s 300ms speed boost to outrun trading bots might come with a hidden cost

Mastercard launches Agent Connect for AI shopping

72.9% of Solana Leader Slots Allocated to Europe, with Germany at 36.1%

Solana Foundation Joins Rust Foundation as Platinum Member

Brazil’s Tokenization Push Accelerates With $2 Billion Credit Plan

Securitize Announces Blockchain-Based Shareholder Registry Infrastructure









