RedStone Smart Contracts bug bounty on HackenProof: up to $250,000
RedStone pays up to $250,000 for critical bugs in its oracle smart contracts on EVM and other chains. The HackenProof program opened on October 22, 2026.
The RedStone Smart Contracts bug bounty is a new program on HackenProof for RedStone, an oracle used by DeFi lending protocols. It started on October 22, 2026 and the page marks it as live.
Rewards depend on severity. Critical bugs pay $50,000 to $250,000, high $10,000 to $50,000, medium $1,000 to $10,000 and low $50 to $1,000. A critical issue means a loss of more than 3% of the total value secured, and a high issue more than 0.3%. When bugs are chained, only the most severe one is paid.
In scope are the EVM pull model contracts and adapters, the Rust SDK, the connectors for Stellar, Sui, Solana and Radix, the on chain relayer contracts on supported chains and the relayer manifests for price feeds. Out of scope are theoretical issues without proof, bugs in imported contracts, gas and style issues, and attacks that only work through front running.
To submit you need 150 reputation points on HackenProof and a proof of concept. Report through HackenProof within 24 hours of finding the bug, using the email of your account. RedStone states it gives a first response and triage within 3 business days each.
RedStone runs a second program on HackenProof for its websites, app.redstone.finance, redstone.finance and docs.redstone.finance, with rewards of up to $10,000 for a critical finding.
Quick answers
Are AI generated reports accepted?
Not without a runnable proof of concept. Reports must also be sent within 24 hours of finding the bug.
Can I contact the RedStone team directly?
No. All communication goes through HackenProof, and no disclosure is allowed without mutual agreement.