Solana's $4.37M Bug Bounty Excludes Known Clock-Drift Flaw

CoinGecko data shows Solana Foundation's 50,000 SOL security contest, worth $4.37 million at current prices, drew a hard boundary around legacy proof-of-history and TowerBFT code paths, leaving a previously disclosed clock-drift vulnerability outside the reward scope. The contest rules, published alongside the bounty announcement, state that "legacy PoH and TowerBFT paths were out of scope." Researchers disclosed a consensus timing flaw in those same paths months before the contest launched. The attack lets a validator manipulate local clock drift to gain disproportionate block production rights, undermining the network's fairness guarantees. per CoinGecko, Solana (SOL) trades at $87.36, up 4.0% in 24 hours and 14.8% over seven days, lifting market cap to $50.9 billion. Volume sits at $4.19 billion. Figures from the desk show the price run coincides with broader market strength, total crypto cap at $2.48 trillion, up 0.68%, but desk chatter ties part of the bid to anticipation of a scope expansion. CoinGecko data shows | Contest USD value | $4.37M | Derived | The omission matters because the clock-drift vector targets the economic incentive layer, validators who exploit timing can extract MEV at protocol scale. Competing chains including Ethereum and Avalanche have addressed similar consensus-timing issues through formal verification and targeted bounties. Solana's approach delegates core consensus review to the validator set, but the contest's scope carve-out suggests the Foundation treats the legacy paths as frozen. No public implementation review covers the specific academic paper describing the attack. The Foundation has not commented on whether a follow-up bounty will target the excluded paths. The next network upgrade candidate, tentatively scheduled for Q4 2026, would be the natural inflection point for any scope change. Watchpoints: a formal scope expansion announcement, a dedicated timing-flaw bounty, or validator-client patches merging before the Q4 upgrade window. Absent one of those, the disclosed vector remains an unpaid risk in the consensus layer.