RedStone Finance has launched two bug bounty programs to incentivize security researchers to identify vulnerabilities in its systems. The smart contract program offers rewards up to $250,000 for critical findings, while a separate web-focused program pays up to $10,000.
The programs went live on October 22, 2026, with a public announcement on October 31. RedStone is hosting the bounties through HackenProof and Cantina, platforms that manage vulnerability submissions and triage.
Bounty Structure
Smart contract rewards by severity:
- Critical: up to $250,000
- High: up to $50,000
- Medium: up to $10,000
- Low: up to $1,000
Web program: up to $10,000 for critical issues affecting RedStone domains.
By late October 2026, more than 201 submissions had been logged on HackenProof.
Scale and Client Base
RedStone operates as a modular oracle provider that supplies pricing data to smart contracts across multiple chains. The company reports securing over $10 billion in DeFi value and counts major protocols among its clients, including Spark, Compound, Morpho, and Lido. RedStone also provides oracle functionality for Securitize products associated with BlackRock and Apollo.
Broader Security Strategy
The bounty programs complement RedStone's existing security measures, which include work with external audit firms Quantstamp and PeckShield. The company describes its security approach as encompassing regular external audits and a rigorous development lifecycle.
