A white-hat hacker questioned Injective's bug bounty mechanism, claiming that they were promised only a $50,000 reward for discovering a "critical" vulnerability.

Techub News reports that white-hat hacker @al_f4lc0n has raised concerns about Injective's bug bounty program. @al_f4lc0n claims to have previously discovered a "critical" vulnerability in the protocol. This vulnerability allowed any user to directly steal funds from any on-chain account without any special privileges, putting over $500 million in on-chain assets at risk. After submitting a report via Immunefi, Injective initiated a mainnet upgrade vote the following day to patch the vulnerability. However, the team provided no response in the subsequent three months. @al_f4lc0n revealed that a few days ago, Injective decided to award a $50,000 bounty, but they disputed the amount, stating that $50,000 is far below the maximum bounty of $500,000 for a critical-level vulnerability, and the $50,000 has not yet been paid. @al_f4lc0n announced that they will allocate 10% of future bug bounty earnings to continue publicizing this issue until Injective pays according to the standard.