Under the terms effective October 18, 2026, researchers must irreversibly transfer 1 SOL to an incineration wallet to qualify for a security bounty. The fee is non-refundable even when a report is a duplicate, invalid or outside the scope of the bounty. The first submission generally receives the reward, while exceptions remain possible for a later report demonstrating greater impact or a wider affected surface. The spring contest received 809 submissions from 162 researchers, producing 127 unique security submissions outside the insight category, with nearly half of valid submissions being duplicates and the queue peaking at 299 open reports. Version v26.10.2 enables Alpenglow in default testnet and devnet configurations, while the terms call for initial contact through GitHub Security Advisory within 96 hours of submission and confirmation of the transfer, with no deadline for validating the flaw, preparing a patch or deploying a fix.
Source: Read the original article
