System Security Project

This semester we got four final project options for System Security class.
1. Find 10 bugs in a open-source project and generate a patch for it.
2. Write a Facebook app to allow friends on Facebook to share files using DC++ directly.
3. Design and develop a bug finding tool.
4. Improve a web server so that even if an attacker breaks into the web site, s/he should not be able to do anything.

All options are quite challenging, so I picked the first one.
But soon I ran into a bottleneck, because there are not that many bugs in software nowadays!
Most classmates who chose same option ran into the same trouble, and the professor said,"This might be a bad thing for you guys, but it is a good thing overall, isn't it?"
Since I started this, I don't want to switch to other project option, because that will waste all my time finding bugs.
Also, since all of us are not able to find that many bugs, the curve for this project will be lower.
Either way will be a win-win situation, so I stay with my project option.