RedStone dares hackers to break its DeFi oracle for up to $250,000

RedStone is offering up to $250,000 to hackers who find critical flaws in its smart contracts, and 201 researchers had submitted reports by October 30, 2026, though HackenProof’s listing showed no bounty payments at that point.

The oracle provider, which says it secures more than $10 billion in DeFi value for protocols including Spark, Compound, Morpho and Lido, opened two programs on October 22, 2026, with a separate $10,000 top reward for web security flaws.

How the bug bounty program rewards are distributed

RedStone has structured its smart contract rewards around the potential impact of each vulnerability. According to its HackenProof listing, eligible researchers can receive between $50 and $250,000, depending on the severity and demonstrated consequences of their findings.

The reward structure is divided into four categories:

The actual reward ranges are broader than these maximum figures. Critical findings qualify for $50,000 to $250,000, while high-severity vulnerabilities attract between $10,000 and $50,000. Medium findings can earn $1,000 to $10,000, and low-severity reports start at $50.

The web security initiative operates separately, with rewards ranging from $200 to $10,000. Critical vulnerabilities receive the maximum payout, while high, medium and low findings carry rewards of $5,000, $2,000 and $200, respectively.

Both programs are listed on HackenProof, which provides a platform for vulnerability reporting and assessment. The smart contract initiative had already attracted 201 submissions by October 30, indicating considerable early interest from the security research community. The web program had also recorded dozens of submissions.

However, a high submission count does not necessarily mean that hundreds of exploitable vulnerabilities have been confirmed. Reports must undergo technical assessment before they can qualify for rewards.

Why Oracle security matters to the wider DeFi market

RedStone’s security initiative carries significance beyond the company’s internal infrastructure because blockchain oracles provide an essential connection between smart contracts and external information.

Blockchains generally cannot independently retrieve real-world information, such as market prices, from external sources. Oracles address this limitation by delivering verified data that decentralized applications can use to execute transactions and enforce financial conditions.

For lending platforms, accurate price feeds are particularly important. They help determine the value of deposited collateral and establish when borrowers’ positions should be liquidated. Incorrect or manipulated information could create opportunities for attackers to exploit lending markets, potentially resulting in substantial financial losses.

RedStone’s growing presence makes these risks especially relevant. The company says its oracle infrastructure secures more than $10 billion in decentralized finance value and supports established protocols, including Spark, Compound, Morpho and Lido.

Its institutional connections also extend into tokenized real-world assets. RedStone was selected by Securitize as an oracle provider for tokenized investment products, including BlackRock’s USD Institutional Digital Liquidity Fund (BUIDL) and Apollo’s Diversified Credit Securitize Fund (ACRED).

In its March 2025 announcement, Securitize confirmed that RedStone would provide price feeds for its existing and future tokenized products. This partnership demonstrates how oracle infrastructure increasingly connects decentralized applications with assets associated with traditional financial institutions.

RedStone co-founder Marcin Kazmierczak previously described the company’s expansion into this market as a foundational step in making tokenized real-world assets usable within DeFi. The development reinforces why reliable data delivery and infrastructure security matter as institutional participation in blockchain finance grows.

Security audits and bug bounties form a wider defense strategy

The new Bug bounty program is not RedStone’s only approach to identifying potential weaknesses. The company has also undergone independent security assessments involving established blockchain security firms, including PeckShield, Cantina, Hacken and other auditing specialists.

RedStone’s official website reports 15 security audits, reflecting an established reliance on external code reviews. However, audits and ongoing vulnerability research serve different purposes.

Traditional security audits generally examine specific codebases, implementations or systems within an agreed scope. A continuous Bug bounty program, by comparison, creates an incentive for independent researchers to investigate eligible targets and report weaknesses that might not have been identified during earlier reviews.

This additional scrutiny is particularly relevant for modular oracle infrastructure operating across multiple blockchain networks. Different integrations, smart contract configurations and data delivery mechanisms can introduce distinct security challenges.

Combining independent audits with ongoing vulnerability reporting gives RedStone additional opportunities to identify weaknesses before they become exploitable. It also creates a structured channel through which researchers can disclose security findings responsibly.

Nevertheless, no security initiative can guarantee that a protocol is completely immune to attacks. The effectiveness of these measures depends on the quality of the assessments, the responsiveness of the development team and the speed at which confirmed vulnerabilities are addressed.

What the development means for DeFi protocols and investors

RedStone’s decision to increase financial incentives for vulnerability disclosures comes as security expectations continue to rise across decentralized finance. Protocols relying on external data providers need confidence that their oracle infrastructure can withstand manipulation, software defects and potential attacks.

For institutional participants, this type of security investment can also influence confidence in infrastructure providers. RedStone’s relationship with Securitize and its connections to tokenized products associated with BlackRock and Apollo make operational reliability particularly important.

The Bug bounty program could therefore strengthen RedStone’s security reputation while encouraging more independent researchers to examine its technology. It may also help the company demonstrate its commitment to protecting the protocols and institutions that depend on its services.

However, the financial incentives alone will not determine whether the initiative succeeds. Researchers and industry participants will ultimately want evidence that legitimate vulnerabilities are acknowledged, investigated and resolved promptly.

There is also an important distinction between reported findings and confirmed security problems. Although the smart contract initiative had attracted 201 submissions by October 30, HackenProof’s listing showed no recorded bounty payments at that point. The number of submissions therefore represents researcher activity rather than proof of 201 successful vulnerability discoveries.

The next phase will depend on how RedStone handles incoming reports, whether critical weaknesses emerge and how effectively identified problems are addressed.