Solana’s Alpenglow bug hunt charges researchers 0.5 SOL to report flaws
Anza is charging safety researchers a non-refundable 0.5 SOL to file every Alpenglow discovering earlier than the competitors closes at 16:00 UTC on Aug. 19.
The rules require each discovering to cross by way of a designated portal, which burns the charge and creates one confidential GitHub Security Advisory. Reports despatched by way of one other channel are ineligible.
The goal is consequential. SIMD-0326 proposes Alpenglow as a backwards-incompatible alternative for Solana’s present Proof-of-History and TowerBFT consensus protocol. Anza has put the brand new consensus elements, their validator integrations and the migration path contained in the bounty’s momentary scope.
Researchers pay the submitting value earlier than Anza determines validity, severity, duplication or reward. They additionally work in opposition to a shifting model of Agave grasp. Each report should establish the commit the place the flaw appeared, reproduce the difficulty there and arrive whereas the bug stays unfixed on grasp.
A proof-of-concept requirement and the submitting burn can cut back placeholder submissions. They may worth out a sound discovering whose impression or precedence is unsure. The printed guidelines comprise no measure of participation or report high quality that will settle the tradeoff.
Researchers pay earlier than eligibility is settled
The competition overview says Alpenglow was excluded from Agave’s standing bounty throughout improvement, monorepo migration and internal-audit phases. The two-week competitors opens an enumerated set of Alpenglow code that features the Votor voting engine, vote and certificates messages, BLS signature and certificates verification, the TowerBFT migration path and specified validator integration surfaces.
Several boundaries stay. Public or beforehand disclosed points don’t qualify. Known points, take a look at code, third-party cryptography dependencies and peculiar TowerBFT-only paths are additionally excluded. Researchers should display findings on a neighborhood fork, multi-node harness or simulation; mainnet and public-testnet assaults are unauthorized.
Priority will depend on proof, not a timestamp alone. The earliest report that meets the proof-of-concept bar at Anza’s assessed severity receives the award for that root trigger. A placeholder reserves nothing. Later duplicates obtain nothing except one substantiates a strictly larger assessed severity.
Eligibility ends when a repair reaches Agave grasp. A report can due to this fact lose its probability of fee in the course of the competitors even when the researcher reproduced the flaw in opposition to an earlier in-window commit.
Under the Alpenglow guidelines, the marketed 50,000 SOL is the biggest mixture pool, unlocked solely by the best severity:
| Highest legitimate discovering | Unlocked pool |
|---|---|
| DoS or Other | 10,000 SOL |
| Liveness or lack of availability | 20,000 SOL |
| Consensus or security violation | 30,000 SOL |
| Loss of funds | 50,000 SOL |
Individual awards use smaller ranges. Loss-of-funds findings obtain 6,250 to 25,000 SOL, consensus or security violations 3,125 to 12,500 SOL, liveness findings 1,250 to 5,000 SOL, and DoS findings 315 to 1,250 SOL.
Anza reduces awards proportionally if the mixed awards exceed the unlocked pool. Fewer or smaller findings can depart a part of the pool unpaid. Even a loss-of-funds consequence unlocks the finances with out elevating any single award above 25,000 SOL.
Payment comes after the Sept. 2 adjudication shut and KYC. Awards are lump sums in SOL locked for 12 months below the standing Agave bounty terms. The submitting burn is speedy; compensation will depend on later adjudication and stays illiquid for a yr.
The Alpenglow bounty covers a consensus migration
Alpenglow’s Votor elements use BLS-based vote and certificates aggregation and verification. Notarization, skip, finalization, and notar-fallback certificates require 60% of stake, whereas quick finalization requires 80%. The preliminary design retains Turbine for knowledge dissemination.
The proposal defines a 20+20 safety mannequin with 40% crash-failure resilience. It labels implementation threat as the principle disadvantage, calls migration difficult, and states that the brand new voting logic is incompatible with its predecessor.
Anza included each core consensus crates and validator code that processes certificates, rewards and finalization state. The TowerBFT handoff is eligible too, placing the joins between outdated and new logic below assessment alongside Votor itself.
The official guidelines and overview nonetheless listed Aug. 19 because the cutoff when checked on Aug. 18, with no extension discover on both web page. The submission window’s shut doesn’t activate Alpenglow or full the migration.
Confidentiality additionally separates the deadline from any public consequence. A discovering stays non-public till its repair ships. Code awaiting mainnet activation can stay below embargo till the repair is merged and the related characteristic gate prompts.
An empty public report after Aug. 19 would reveal nothing concerning the variety of advisories. Before adjudication, the disclosed economics inform the story: 0.5 SOL leaves a researcher’s pockets first, proof determines precedence, and solely a substantiated loss-of-funds flaw opens the total pool.
The put up Solana’s Alpenglow bug hunt charges researchers 0.5 SOL to report flaws appeared first on CryptoSlate.
