Solana Foundation
Non-profit supporting the Solana blockchain — a high-performance network processing 65,000+ TPS for DeFi, NFTs, and payments.
https://solana.orgMax Reward
$400,000
Total Paid
$2,900,000
Resolved
167
Avg Response
3 days
In-Scope Assets
Solana Validator
Core validator client and consensus
Solana Runtime
Transaction processing and program execution
SPL Programs
Token, governance, and stake programs
Solana Web3.js
JavaScript SDK and RPC client
Out of Scope
- ✕ Third-party dApps on Solana
- ✕ Solana Ecosystem projects
- ✕ Marketing materials
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| SOL-001 | Validator consensus manipulation via crafted vote transactions | Critical | Open | $100,000–$400,000 | 0 |
| SOL-002 | SPL Token account authority hijack via program upgrade | Critical | In Review | $50,000–$200,000 | 1 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.