Solana Bug Bounty Ignored Previously Disclosed Clock Attack
A 50,000 SOL security contest excluded legacy Proof of History and TowerBFT paths despite earlier warnings.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- Solana's 50,000 SOL security contest excluded legacy PoH and TowerBFT paths.
- A clock attack disclosed months earlier fell outside the competition's scope.
- No public paper-specific implementation review has been released.
Solana recently ran a 50,000 SOL security contest, but they conveniently left out a known clock attack vector disclosed months earlier.
Critical Consensus Paths Out of Scope
Security competitions exist to catch hidden flaws before hackers do. Yet Solana explicitly ruled its legacy Proof of History (PoH) and TowerBFT consensus paths out of scope for the event.
Because those core components were off-limits, white-hat security researchers couldn't target them for bounties. To make matters worse, Solana hasn't made any paper-specific implementation review public to show how they're handling those risks.
Why it matters
A bug bounty only protects the code it actually covers. If you hold SOL or use the network, keeping core consensus mechanisms out of high-stakes security contests leaves dangerous blind spots open to real-world exploits.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇹🇷 Showing sites that accept players from Turkey Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-facing book that pays a premium for crypto deposits: 125% against 100% for cash, with fee-free deposits across five coins.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
More info Less info
Why we chose it: Phemex is a derivatives-first venue for Europe, Asia and Latin America. Good engine, mid-size liquidity, and a blocklist that grew in 2025.
- Online since
- 2019
- Licence
- Seychelles
- KYC
- Required
Restricted countries: United Arab Emirates, Afghanistan, Australia, Belgium, Bermuda, Belarus, Ontario (Canada), China and 18 more.
More info Less info
Why we chose it: BetNow's casino floor with the biggest match bonus we list. The 200% headline deserves a careful read of the code terms behind it.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
Sofia Marek
Sofia reviews exchanges and crypto casinos, focused on fees, safety and what actually reaches the player.
