[Tour de SOL] Stage 5 - Details


Introductory Note

Thanks to everyone that participated in Stage 4. With us now moving into June, we’re going to be shifting into Stage 5. The key area features enabled in Stage 5 are:

  • Cross program invocation - The ability for different smart contracts to interact with each other
  • Optimistic confirmation - Read more about this feature here

As a result key areas we’d like to invite hackers to explore are:

  • Cross-program invocation attacks
  • Optimistic confirmation attacks

To point everyone in the right direction, we’ve put together a quick-start guide to Smart Contracts on Solana at the end of this thread. As we’ve created a specific compensation category for Smart Contract related bugs in this stage, we encourage everyone to familiarise themselves and take some time to walk through the information.

Stage 5 - Details

  • Start Date/Time: Wednesday, 10th of June, ~10:00am PT
  • Estimated Duration: 4 weeks
  • Malicious behaviour will be incentivised
  • The focus of Stage 5 will be Smart Contracts and Optimistic Confirmations

Registration closes the 8th of June 8:00am PT

Future Stages

  • Additional details will be announced progressively depending on the progress made on the previous stages
  • Within each stage the allowable attack surface will vary depending on engineering goals and any new features enabled with each new release. Similarly, metrics upon which participants will be measured against will vary to suit
  • Our intention at this point in time is for each Stage to run for up to approximately 4 weeks.
  • Future stages will not start until the previous stage is complete

Note that we reserve the right to change the schedule/duration if required, but we’ll endeavour to provide clear and ample notification if so.

Attack Surface

Each Stage will be configured to behave exactly like the next-in-line upgrade for the Mainnet Beta network at each respective point in time. Participants can expect the attack surface to grow over time as more features are enabled. We’ll be continuing with the v1.2.x release line for Stage 5.


Compensation has remain unchanged since Stage 4. Recap on the structure provided below.


This will be measured by multiple factors, including but not limited to if you’ve joined the network, are actively staked, are responsive to issues (i.e. don’t become delinquent, or actively work to resolve the issue if you become delinquent), implement patches/upgrades within a reasonable timeframe and remain so until the end of the stage.

Compensation Amount: 2,000 SOL per participant

Security Bug Bounties
We’ll be incentivising participants for identifying security issues within the network. This has been renamed because the previous title gave the impression to participants that an attack had to be successfully executed to be eligible for compensation. This is not the case, participants that reveal a security attack vector to the team, without executing the attack will still be eligible. Security Bugs will still be classified into several overarching categories:

Critical Bugs

  • Loss of Funds/Safety Violation:
    • 50,000 SOL
  • Loss of of Availability (i.e. halting the network or preventing consensus from moving forward)
    • 25,000 SOL
  • DoS (i.e. flooding the node with messages, but not overwhelming the hardware)
    • 20,000 SOL
  • Any bugs that are ‘Critical’ but do not fall under the above categories will be assessed on the case by case basis and awarded
    • Up to 50,000 SOL

Smart Contracts Bugs
Bugs specifically relating to Solana’s smart contract module

5,000 SOL each

Non-Critical Bugs
Any other security bugs that are identified but don’t fall within the ‘Critical’ category.

3,000 SOL each

Accidental Bug Identification
Bugs that are accidentally identified by any participant during Tour de SOL will still be eligible for compensation. Note that individuals are responsible for adding the following comment in the issue “Found in TdS Stage #” and requests the Solana team to add the “tour-de-sol” label to the issue, otherwise it won’t be counted

3,000 SOL each

The introduction of this is not to discount the amount of effort required to deliberately identify exploits, but to encourage and incentivize participants for experimenting and exploring the code.

Eligibility for Bug Compensations:

  • The participant submitting the bug bounty still must file a github issue, describing the attack to be eligible (amongst registration requirements etc.) for the compensation.
  • Valid exploits can be eligible even if they are not successfully executed on the cluster
  • Multiple submissions for the same class of exploit are still eligible for compensation, though may be compensated at a lower rate, however these will be assessed on a case-by-case basis
  • Note that individuals are responsible for adding the following comment in the issue “Found in TdS Stage #” and requests the Solana team to add the “tour-de-sol” label to the issue, otherwise it won’t be counted

Other Notes:

  • As with all previous compensation, SOL earned are locked for 12 months and will be distributed quarterly in general
  • U.S. individuals and entities are EXCLUDED from participating

Communication Channels for the Event:

  • Solana Discord : We’ve set up a channel titled #tourdesol-announcements which you can join to stay up to date on any major updates related to the events
  • For any questions please reach out to Dominic (watch out for imposters):

Quick-Start Guide

General Documentation:

  1. Our Solana Github
    Solana has been completely open-source from inception. You’ll find all of our code within this repository here
  2. Our Web3 SDK
    This is the Solana Javascript API built on the Solana node RPC
  3. Solana Technical Documentation
    These explain why Solana is useful, how to use it, how it works, and why it will continue to work long in the decades to come
  4. Solana Node RPC

Examples to Dive Right In:

  1. Building a Simple ERC20-Like Token on Solana
    This is a quick example demonstrating how you would use the Solana Javascript API to build, deploy, and interact with an ERC20-like Token example program on the Solana blockchain. For convenience the:
  2. On-Chain Entry Point is here
  3. Client-Side Entry Point is here
  4. On-Chain Program Entry Point is here
  5. Program Entry Point is Dispatched here

Final Words

As always feel free to reach out if you have any queries or concerns. A friendly reminder that participants need to complete registration for us to be able to distribute compensation. If you have issues on that front please also reach out.