Alpenglow bug hunt charges 0.5 SOL — filing fee, weird rules & payouts

The filing fee and how the process actually works

If you want to tell Anza about a bug in Alpenglow, you now have to pay 0.5 SOL up front — non-refundable, burned on submission. That payment must go through a specific portal they set up; filings sent any other way won’t count. The portal also creates a confidential security advisory on GitHub, so the report stays private until a fix lands.

Paying doesn’t guarantee cash back or even a prize. Anza checks a report’s validity, severity and uniqueness after you’ve already handed over the fee. You also have to prove the bug on a moving target: the repository’s master branch keeps changing, and each report must point to the exact commit where the issue first showed up and reproduce it on that commit while it’s still unfixed.

There’s a mandatory proof-of-concept requirement. That’s meant to stop placeholder submissions, but it also means researchers might have to sink the 0.5 SOL for borderline findings whose value is unclear. In short: you pay first, argue later — and if evidence doesn’t convince the judges, you’re out of pocket.

What’s in scope, what’s out, and how to demonstrate a bug

The competition covers a specific slice of Alpenglow code: the new voting engine, vote and certificate messages, BLS signature and certificate verification, validator integration points, and the migration surface where the old consensus hands off to the new one. Anza even included the migration logic itself so the tricky joins between old and new code are fair game.

Not everything is on the table. Publicly known issues, previously disclosed problems, test-only code, third‑party crypto libraries and ordinary paths that belong only to the legacy consensus are excluded. You also can’t attack mainnet or public testnets — demonstrations must happen on local forks, multi-node harnesses or simulations.

Priority isn’t a pure race. The reward for a given root cause goes to the earliest submission that meets the proof‑of‑concept bar at the severity Anza assigns. A placeholder submission doesn’t reserve a prize, and later duplicates get nothing unless they prove a strictly higher severity. Also remember: if a fix gets merged to the Agave master branch, eligibility for that issue ends even if you reproduced it against an earlier commit.

Prizes, timelines, and delightful quirks

The headline pool is large — up to 50,000 SOL — but that total is only unlocked by the highest‑severity findings. Individual award ranges are tiered: loss‑of‑funds issues sit at the top, then consensus/safety, liveness, and DoS problems in decreasing order. If the sum of winners would exceed the unlocked pool, awards are scaled down proportionally, and any leftover budget can remain unpaid.

Payouts happen after adjudication — the window closes for judging on a specified date, and winners must complete KYC. Awards are paid in SOL but are locked for 12 months under the standing bounty terms, while the 0.5 SOL filing burn is immediate and irreversible.

Technical tidbits for the curious: the new voting pieces use BLS aggregation for votes and certificates, notarization and fallback certificates require roughly 60% of stake, and fast finalization needs about 80%. The design targets around 40% crash‑failure resilience and keeps the existing data dissemination layer in place. Implementation risk and a tricky migration were flagged as the main downsides — so yes, it’s powerful but fiddly.

Bottom line: this contest tries to balance meaningful incentives with confidentiality and a moving codebase. It discourages noise with a filing fee and a proof‑of‑concept gate, but that same gate can price out borderline but valid discoveries. If you’re a researcher, weigh the 0.5 SOL burn against the chance of grabbing a real payout — and don’t forget to reproduce the bug on the exact commit you cite.