RedStone Finance has put a price on its own weak spots. The modular oracle provider has launched two bug bounty programs that pay security researchers to surface smart contract and web vulnerabilities before attackers can exploit them.

The flagship program covers smart contract findings and offers a top reward of $250,000 for critical vulnerabilities. A second program addresses web-facing issues, with payouts of up to $10,000.

Bug bounty programs are a well-established practice in the software industry and have become increasingly common among cryptocurrency infrastructure firms. They invite independent researchers to probe a company's systems for exploitable flaws and report them responsibly in exchange for compensation, with payouts typically scaled to the severity of the issue.

Both programs went live on October 22, 2026, though RedStone announced them publicly on October 31 — a nod to Halloween, with the company branding the launch as “treats for bugs.”

How the Bounties Are Structured

Rewards under the smart contract program scale with the severity of the finding:

• Critical: up to $250,000
• High: up to $50,000
• Medium: up to $10,000
• Low: up to $1,000

The web bounty tops out at $10,000 for critical issues affecting several RedStone domains.

RedStone is not administering the programs in-house. Instead, the bounties are hosted on HackenProof and Cantina, two specialized web3 security platforms that handle vulnerability submissions and triage, giving researchers a standardized channel for submitting reports and collecting payouts. By late October 2026, more than 201 submissions had already been logged on HackenProof, signaling active researcher engagement.

Why Oracle Security Carries Extra Weight

Smart contracts cannot look outside their own network to check the price of an asset. Oracles supply that external data, allowing lending protocols to know when to liquidate a loan and how much collateral is worth. A single manipulated or stale price feed can therefore distort valuations across every protocol that depends on it. Price feed manipulation has, in fact, been a recurring attack vector across past DeFi exploits, which is why feed integrity sits at the center of the sector's security concerns.

RedStone's scale raises the stakes. The company says it secures more than $10 billion in DeFi value. Its client list includes protocols such as Spark, Compound, Morpho, and Lido. RedStone also provides oracle functionality for Securitize products associated with BlackRock and Apollo.

Part of a Wider Security Playbook

The bounties are not RedStone's only line of defense. The company already works with external audit firms, including Quantstamp and PeckShield, and frames the new programs as one layer in a broader strategy that combines regular external audits with what it describes as a rigorous development lifecycle. Pairing periodic audits with standing bounty programs has become a common operating pattern across DeFi infrastructure.

RedStone is described as a rapidly growing modular oracle provider operating multichain infrastructure, with the modular label reflecting an on-demand delivery model in which protocols pull price data only when needed rather than having every update pushed on-chain.

What It Means for DeFi Protocols and Institutions

The initiative may enhance confidence in RedStone's operational integrity. Given RedStone's role supporting Securitize products tied to BlackRock and Apollo, visible investment in security could help sustain existing relationships and potentially attract new institutional clients.

The more than 201 early submissions on HackenProof suggest researcher interest is strong. The real test, however, will be how RedStone handles the reports, how quickly valid findings are fixed, and whether any critical-tier payouts ever materialize.

Source: CryptoBriefing. This article is based on reporting edited by Estefano Gomez.