Solana Alpenglow Bug Bounty Closes With 300+ Reports Ahead of Mainnet Launch

MakeCryippreferred on

Solana’s dedicated Alpenglow bug bounty closed August 19, drawing what’s said to be more than 300 vulnerability submissions for a prize pool of up to 50,000 SOL, roughly $5 million at current prices.

Alpenglow is Solana’s biggest consensus change since launch. It replaces the network’s TowerBFT and Proof of History system with a new voting mechanism called Votor, targeting roughly 150 millisecond transaction finality instead of the current 12.8 seconds, according to Solana’s own upgrade page.

This was the first bug bounty ever run specifically against Alpenglow’s own code, rather than Solana’s broader codebase, per the program’s rules on Anza’s GitHub repository. Anza, the company that maintains Solana’s validator software, has scheduled Alpenglow’s mainnet activation for September 28, about six weeks after the contest closed. Submissions are still being adjudicated, with that process due to finish September 2.

How the Last Six Weeks Line Up

• December 2025: A consensus-timing flaw in Solana’s current clock system is privately disclosed to Solana developers.
• May 11, 2026: Alpenglow’s first live testnet migration breaks on the initial attempt and requires a hotfix and restart.
• August 5, 2026: The dedicated Alpenglow bug bounty opens, offering up to 50,000 SOL.
• August 12, 2026: The clock-timing flaw is presented publicly at the USENIX Security conference, one week before the bounty closes.
• August 19, 2026: The bounty closes with 300+ reported submissions.
• September 2, 2026: Adjudication of submissions is due to conclude.
• September 28, 2026: Alpenglow is scheduled to activate on Solana’s mainnet.

A Known Gap in the Contest’s Scope

One relevant vulnerability didn’t need a bounty to surface. Researchers privately told Solana’s developers in December about a flaw in the network’s current timing system: a validator scheduled to produce a block can withhold it, let other validators’ internal clocks advance, then release that block stamped with an earlier time. That resets the network’s shared clock and can crowd out other validators’ turns to propose blocks.

The flaw was presented publicly at the USENIX Security conference on August 12, a week before the Alpenglow bounty closed. It was excluded from the contest’s rewards because it lives in the TowerBFT and Proof of History code that Alpenglow is designed to retire, not in Alpenglow itself.

Solana’s team has said it already knew about the behavior internally and expected an upgrade like Alpenglow to close it. Anza and the Solana Foundation have not published a specific analysis showing the new system actually does.

What a Report Was Worth

This isn’t the first time Alpenglow’s testing looked cleaner in public than it did internally. The upgrade’s first live testnet migration, on May 11, broke on the initial attempt: a bug in the old TowerBFT and Proof of History code, plus a validator that blocked connections to its peers, forced a hotfix and a restart.

Alpenglow vs. Solana’s Current Consensus

Anza and the Solana Foundation are still reviewing the bounty’s submissions, with adjudication due to finish September 2, about four weeks before Alpenglow is scheduled to go live.

A Separate Fee Fight Among Validators

Separately, Solana validators are voting on SGP-3, a proposal to route priority fees to validators instead of burning most of them, as the network currently does. Co-founder Anatoly Yakovenko has defended the change as a “super easy way to align incentives,” so long as there are no side-channel attacks and rival teams aren’t building alternative TPU ports.

He has said SGP-3’s starting price is a static rate per requested compute unit, well below the roughly 50% priority-fee burn Solana ran a year ago and close to the network’s current signature base fee, while some of Solana’s most-used apps continue to push back on the proposal.