What happened
RedStone disclosed the launch of its bug bounty programs on Friday, with top rewards reaching $250,000 for critical-severity vulnerabilities, according to CryptoBriefing's report. The programs cover the full oracle stack, including the push model, which streams prices on-chain at regular intervals, and the pull model, which delivers signed price updates on demand. Scope and payout tiers scale by exploitability, impact on integrated protocols, and the quality of the submitted proof of concept.
RedStone's oracle data is consumed by lending markets, perpetual exchanges, and real-world asset platforms across Ethereum, Arbitrum, Base, and other EVM chains. The company did not publish a cap on total program spend. Researchers are directed to RedStone's disclosure portal for submissions.
Why it matters
Oracles are the single point of failure most responsible for DeFi's biggest losses. Mango Markets lost $117 million in October 2022 to a price manipulation attack that exploited thin oracle inputs. Compound and Aave have both pushed emergency parameter changes after oracle anomalies.
A $250,000 top payout is competitive. Chainlink runs a program through Immunefi with critical rewards up to $1 million for its CCIP cross-chain protocol, while Pyth's bounty tops out around $500,000 for its on-chain components. RedStone pricing itself in the mid-six figures puts it inside the band institutional allocators expect before green-lighting integrations.
The move also signals the oracle category is still consolidating. Protocols shopping for a feed in 2026 are not choosing on latency alone. Security posture, audit history, and active bounty spend are now part of the integration due diligence.