How to Report Solana Bugs: Step by Step Guide.

Okay, so you found a bug in something Solana related? Awesome. Reporting it right means you might snag some cash from bug bounties, or at least help keep the network smooth. I usually just jump in quick 'cause Solana moves fast. Don't overthink it-grab details, pick the spot, and hit send. Sound familiar?

But first, figure out what you're dealing with. Core Solana blockchain? A DEX like Raydium? Some NFT project? Or a validator client like Firedancer? Each has its own way. The thing is, messing this up wastes everyone's time. Why does this matter? 'Cause 80% of reports get ignored if they're vague.

Spot the Bug Type First

Look, bugs hit different. Smart contract glitch that drains funds? Network halt? Or just a UI fart? Critical ones pay big-up to $2 million for core Solana stuff that could steal billions or crash consensus. High risk? Think $5k to $100k. Low? Maybe hall of fame or zip.

In my experience, start by checking if it's bounty eligible. Solana's main program on Immunefi covers blockchain, APIs, smart contracts. Firedancer? Separate, up to $500k max. Projects like Raydium throw $2.3 million pots. Solscan? Caps at $2500/month, paid in crypto.

Quick Reward Cheat Sheet

Target	Critical Payout	High Payout	Notes
Solana Core (Immunefi)	Up to $2M USDC/SOL	$5k+	KYC needed
Firedancer	$100k-$500k USDC	$5k-$50k	Proof of concept required
Raydium	Up to $2.3M	Varies	Smart contracts focus
Solscan	$1k-$3k crypto	$500	Monthly cap $2500

Pretty much covers the big ones. Now, what's next?

Prep Your Report Like a Pro

1. Reproduce it. Every time. No "it happened once" crap. Steps must work for devs blind.
2. Note everything: App version, Solana network (devnet/testnet/mainnet), your wallet, RPC endpoint. Error logs? Screenshot city.
3. Expected vs. actual. "Should mint NFT. Got nothing but gas fee burn of ~0.000005 SOL."
4. Impact? "Lets anyone drain pool. Loses $10k USDC."
5. PoC code if smart contract. Rust snippet or transaction ID from Solscan.

Honestly, I copy paste transaction sigs from explorers. Makes it dead simple. And attach video if it's flaky-devs love that.

Core Solana Bugs? Email First

Don't GitHub issue for security stuff. Solana's policy: security@solana.com. Give your GitHub username. They'll add you to a private advisory.

Why email? Public issues tip off bad actors. Once reported, they assess. Bounties? Prefix like "[Bounty Category: Critical: Loss of Funds]". First reporter wins. Multiples? Maybe lower payout.

Payment in 30 days post invoice. SOL at Coingecko close price that day. KYC via solana.foundation if needed.

Bug Bounties on Immunefi or HackenProof

Most action here. Sign up, KYC for payouts (passport, wallet proof). Scope tight: Solana repo, program library. No Discord hacks or third party.

1. Read rules. Out of scope? Rejected.
2. Hunt: Rust for programs, fuzzers for edge cases. Tools like Soteria or X Ray scan for signer misses, overflows.
3. Submit form: Steps, impact, PoC. Creative bugs get bonuses.
4. Wait. They triage, pay USDC on Solana.

Act fast on new launches. Follow @solana on X, join Discord. Firedancer drops? Jump in weekend fuzz-someone bagged $200k that way.

Project Specific? Check GitHub or Discord

• GitHub issues: Most have template. Serum DEX? Describe, version, repro steps.
• Discord/Telegram: #bugs channel usually. Solana Stack Exchange for questions first.
• No bounty? Still report. Builds rep. I got early access to testnets that way.

But watch pitfalls. Scanner noise? No reward. Same bug twice? Nope. Social engineering? Legal trouble.

Example: Smart Contract Miss

Say missing signer check. Anyone calls admin func, sets themselves boss. Repro:

1. Deploy test program devnet.
2. Call update_admin without signer flag.
3. Boom, new admin. Impact: Full control, drain funds.

Report with tx sig. Pays high if in scope.

Common Screw Ups and Fixes

Vague steps. Fix: Number 'em. "1. Connect Phantom. 2. Swap 1 USDC on Raydium mainnet v4.2.3. 3. Tx fails with 'Account not found'."

No impact. Always add: "Could rug $50k pool."

Wrong spot. Core bug? Email. App bug? Their GitHub.

Impatient. Devs take weeks. Be polite: "Hey team, found this-lmk if needs more deets."

Scams. Fake DMs promising bounties? Ignore. Stick to official Immunefi/HackenProof.

Skills to Level Up

You'll need Rust basics for programs. Know PDAs? Pubkey::findprogramaddress(&[b"seed"], program_id). Miss it, bump wrong, exploits galore.

Security hits: No signer check, reentrancy, integer overflow. Tools? X Ray: x ray -analyzeAll . in program dir. Flags account confusion fast.

Fuzzing? Weekend grind for resource exhaustion bugs. One guy hit Solana with heap alloc fail in symbol report.

In my experience, run devnet validator. Costs ~0.1 SOL setup. See tx flow real time.

Non Bounty Reports Still Rock

Not every bug pays. UI glitch in Solscan? Their form. Smart contract not yours? GitHub issue in repo.

Validators welcome reports too. Strengthens network. Earn staking SOL separate-hardware heavy tho.

Projects like SNS (Solana Name Service): Immunefi partnered, $1k-$100k for contracts. KYC post valid.

One Last Nudge

Grab Solana GitHub, fork, test. Join Discord, lurk #security. Report one small bug first-gets easier. You'll be hunting criticals in no time. Questions? Hit me.

Oh, fees? Bug reports free. But testing tx? ~0.000005 SOL per. Devnet cheaper.

(Note: