RedStone Finance publicly announced its two bug bounty programs on October 31, 2026, offering researchers up to $250,000 for critical smart contract vulnerabilities. The RedStone bug bounty programs went live on October 22, 2026, with a separate reward pool covering flaws in its web-facing services.
Key takeaways
Critical web flaws qualify for rewards of up to $10,000.
HackenProof recorded more than 201 submissions by late October 2026.
RedStone says its oracle services secure over $10 billion in DeFi value.
How the RedStone bug bounty rewards work
The smart contract program pays according to the severity of a reported vulnerability. Alongside the $250,000 critical-tier ceiling, rewards reach $50,000 for high-severity findings , $10,000 for medium-severity issues and $1,000 for low-severity flaws.
The second program targets web-facing vulnerabilities affecting several RedStone domains. Its maximum payout is $10,000 for critical issues .
The modular oracle provider is paying researchers to identify weaknesses in its smart contracts and web services before attackers can exploit them.
HackenProof and Cantina handle submissions
HackenProof and Cantina host the programs and manage vulnerability submissions and triage, rather than RedStone running those processes in-house.
By late October 2026, HackenProof had logged more than 201 submissions . That figure records reports submitted to the platform, not confirmed vulnerabilities or reward payments.
Oracle security reaches beyond RedStone
RedStone says it secures over $10 billion in DeFi value across its clients. Those clients include Spark, Compound, Morpho and Lido, while its oracle functionality also supports Securitize products associated with BlackRock and Apollo.
Oracles supply outside information to blockchain applications. Smart contracts cannot independently check asset prices beyond their own network, so lending protocols use oracle data to value collateral and determine when loans require liquidation.
That role puts the security of RedStone’s multichain infrastructure alongside the financial operations its clients perform. The bounty programs target weaknesses in the services delivering that data.
Bounties sit alongside audits and development controls
RedStone frames the bug bounty programs as one part of a broader security strategy, alongside regular external audits and what it describes as a rigorous development lifecycle.
Research suggests the initiative may enhance confidence in its operational integrity among DeFi protocols and institutional investors. The programs add researcher-led testing to its existing security work, which includes external audits by Quantstamp and PeckShield .
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
