Injective Offered $50K for $500M Bug — White Hat Says Reward Violates Policy

A white-hat researcher known as f4lc0n reported a critical Injective vulnerability that could have allowed attackers to drain more than $500 million of on-chain assets and empty arbitrary accounts. Injective applied a mainnet upgrade to patch the flaw, but the team remained largely silent for about three months before offering a $50,000 bug-bounty payment. f4lc0n disputes the award, saying it contradicts Injective’s public bug-bounty policy that ties maximum payouts to a percentage of funds at risk (up to 10%), and alleges the project provided no clear methodology for calculating the payment. The researcher has not received the $50,000 and says they will publicize the dispute and allocate 10% of future bounties to pressure Injective until full compensation is paid. Industry norms for critical, fund-theft vulnerabilities typically see much larger payouts (often $250k–$1M+), plus timely, transparent communication under responsible disclosure. The episode raises concerns about incentive alignment, disclosure practice, and protocol responsiveness—factors traders should weigh when assessing Injective’s security risk and counterparty reliability.