RedStone opens two bug bounty programs with rewards of up to $250,000
In brief
- RedStone's smart contract bounty pays up to $250,000 for critical vulnerabilities.
- A separate web-facing program pays up to $10,000 for critical issues.
- Both programs went live October 22, 2026; RedStone announced them publicly October 31.
- HackenProof and Cantina host the bounties; HackenProof logged more than 201 submissions by late October.
Two programs, two scales
The smart contract program is the bigger of the two, and rewards scale with severity. According to RedStone's announcement as reported by Crypto Briefing, critical findings pay up to $250,000, high-severity bugs up to $50,000, medium up to $10,000 and low up to $1,000.
The second program covers web-facing issues. It tops out at $10,000 for critical problems affecting several RedStone domains.
RedStone isn't running either one in-house. The bounties are hosted on HackenProof and Cantina, two platforms that handle vulnerability submissions and triage (instead of a process the team manages itself). Crypto Briefing reported that more than 201 submissions had been logged on HackenProof by late October, and the programs had only gone live on October 22.
"treats for bugs" (RedStone's branding for the public launch)
Why oracle bugs matter
Smart contracts can't check the price of an asset outside their own network. Oracles bring that outside data in, and lending protocols use it to decide liquidations and collateral value.
RedStone says it secures over $10 billion in DeFi value. The company says its client list includes Spark, Compound, Morpho and Lido, and that it provides oracle functionality for Securitize products associated with BlackRock and Apollo.
The $250,000 ceiling applies only to critical smart contract findings.
One layer of several
RedStone frames the bounties as one layer in a broader security strategy, not a replacement for existing reviews. That strategy includes regular external audits and what the company describes as a rigorous development lifecycle. It already works with outside audit firms, including Quantstamp and PeckShield.
The bounties sit on top of those audits. Outside researchers now have a paid way to report what they find, through two third-party platforms, with payouts tied to how severe the bug is.
Frequently asked questions
How much does RedStone's bug bounty pay?
RedStone's smart contract program pays up to $250,000 for critical vulnerabilities, $50,000 for high, $10,000 for medium and $1,000 for low severity. A separate web-facing program pays up to $10,000 for critical issues affecting several RedStone domains.
Where do researchers submit bugs to RedStone?
The bounties are hosted on HackenProof and Cantina, two platforms that handle vulnerability submissions and triage. Crypto Briefing reported more than 201 submissions logged on HackenProof by late October 2026.
Why does oracle security matter for DeFi?
Smart contracts can't check asset prices outside their own network, so oracles supply that outside data. Lending protocols use it to determine liquidations and collateral value.
