The second program targets web-facing vulnerabilities affecting several RedStone domains. Its maximum payout is $10,000 for critical issues.
The modular oracle provider is paying researchers to identify weaknesses in its smart contracts and web services before attackers can exploit them.
HackenProof and Cantina handle submissions
HackenProof and Cantina host the programs and manage vulnerability submissions and triage, rather than RedStone running those processes in-house.
By late October 2026, HackenProof had logged more than 201 submissions. That figure records reports submitted to the platform, not confirmed vulnerabilities or reward payments.
Oracle security reaches beyond RedStone
RedStone says it secures over $10 billion in DeFi value across its clients. Those clients include Spark, Compound, Morpho and Lido, while its oracle functionality also supports Securitize products associated with BlackRock and Apollo.
Oracles supply outside information to blockchain applications. Smart contracts cannot independently check asset prices beyond their own network, so lending protocols use oracle data to value collateral and determine when loans require liquidation.
That role puts the security of RedStone’s multichain infrastructure alongside the financial operations its clients perform. The bounty programs target weaknesses in the services delivering that data.
Bounties sit alongside audits and development controls
RedStone frames the bug bounty programs as one part of a broader security strategy, alongside regular external audits and what it describes as a rigorous development lifecycle.
Research suggests the initiative may enhance confidence in its operational integrity among DeFi protocols and institutional investors. The programs add researcher-led testing to its existing security work, which includes external audits by Quantstamp and PeckShield.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
en.cryptonomist.ch
