The modular oracle provider is paying researchers to find smart contract and web vulnerabilities before attackers do
RedStone Finance is putting a price on its own weak spots. The modular oracle provider has rolled out two bug bounty programs, with the top reward reaching $250,000 for critical smart contract vulnerabilities.
A second program covers web-facing issues and pays up to $10,000.
The programs went live on October 22, 2026, but RedStone announced them publicly on October 31, branding the launch as “treats for bugs.”
How the RedStone bounties are structured
The smart contract program is the headline act. Rewards scale with severity.
Here is the breakdown for smart contract findings:
Critical: up to $250,000
High: up to $50,000
Medium: up to $10,000
Low: up to $1,000
The web bounty tops out at $10,000 for critical issues affecting several RedStone domains.
RedStone isn’t running the programs in-house. The bounties are hosted on HackenProof and Cantina, two platforms that handle vulnerability submissions and triage.
By late October 2026, more than 201 submissions had already been logged on HackenProof.
Why oracle security carries extra weight
Smart contracts can’t look outside their own network to check the price of an asset. Oracles bring that outside data in, so lending protocols know when to liquidate a loan or how much collateral is worth.
That’s where RedStone’s scale becomes relevant. The company says it secures over $10 billion in DeFi value.
Its client list includes protocols such as Spark, Compound, Morpho, and Lido. The company also provides oracle functionality for Securitize products associated with BlackRock and Apollo.
Part of a wider security playbook
The bounties aren’t RedStone’s only line of defense. The company already works with external audit firms, including Quantstamp and PeckShield.
RedStone frames the programs as one layer in a broader strategy that includes regular external audits and what the company describes as a rigorous development lifecycle.
The research describes RedStone as a rapidly growing modular oracle provider operating multichain infrastructure.
What this means for DeFi protocols and investors
The research suggests the initiative may enhance confidence in RedStone’s operational integrity.
Given RedStone’s role supporting Securitize products tied to BlackRock and Apollo, visible security investment could help sustain existing relationships and potentially attract new institutional clients.
The more than 201 early submissions on HackenProof suggest researcher engagement is active. The real test will be how RedStone handles the reports, how quickly valid findings are fixed, and whether any critical-tier payouts ever materialize.
