Alpenglow is Solana's new consensus protocol. During development, monorepo migration and internal audit phases, the Alpenglow logic has been excluded from scope of the Agave bug bounty program. To mark its introduction to eligibility, we're hosting a bug bounty competition to raise awareness and catch standing issues that have evaded prior review efforts
- Prize pool: up to 50,000 SOL
- Submission window: 2026-08-05 16:00 UTC to 2026-08-19 16:00 UTC
- How to submit: open a GitHub Security Advisory on this repository, one finding per advisory
- Full rules: RULES.md (scope, severity categories, rewards, eligibility, and duplicate policy)
Do not disclose a finding publicly (for example as a GitHub issue
here or on agave), as public findings are ineligible for a reward.
Findings submitted outside the window are handled under the standing
Agave security policy
The Alpenglow consensus code subject to the competition is hosted in Anza's Agave GitHub repository
anza-xyz/agave. Begin with:
votor: the voting enginevotor-messages: vote and certificate typesbls-sigverify: BLS signature verificationbls-cert-verify: certificate verification and stake-threshold checks
These four crates are the core, but the scope extends to the Alpenglow integration surface across the validator; see RULES.md section 3 for the full list.
Background: the Alpenglow whitepaper and SIMD-0326.
To recap, the code subject to the competition resides in the Agave repository, while competition submissions will be made to this repository
The tracker below lists issues found during Alpenglow's development and review. They can point you to areas worth investigating, but they are also the known-issues baseline: anything already listed there (or otherwise public) at the time you submit is out of scope (RULES.md section 8):
Alpenglow related issues on Agave
Follow @anza_xyz on X and Watch this repository. Further competition details will be announced in both places.