White Hat Hacker Discovers $500M Vulnerability in Injective, Receives $50K Bounty Dispute

ChainCatcher report: White-hat hacker f4lc0n disclosed on X that he found a “critical” vulnerability in the Injective protocol allowing any user to directly withdraw over $500 million in on-chain assets without special permissions. However, the project offered only a $50,000 bounty—far below the $500,000 maximum reward specified for critical-level issues in their program. f4lc0n stated that the flaw permitted any user to empty any on-chain account. After submitting the report via Immunefi, the Injective team initiated a mainnet upgrade vote the next day to fix the issue, but then went silent for the following three months. f4lc0n has now contested the bounty amount, noting that the $50,000 has not yet been paid. He announced he will donate 10% of all future vulnerability reward earnings to publicly raise awareness of this issue until Injective pays the standard reward.