BlockBeats report, March 16: White-hat hacker f4lc0n disclosed a "critical" vulnerability in the Injective protocol that could allow direct extraction of over $500 million in on-chain assets, but the project team offered only a $50,000 bounty—far below the planned maximum of $5 million for this severity level.
f4lc0n stated that the vulnerability allowed any user to empty any on-chain account without special privileges. After submitting the report through Immunefi, the Injective team initiated a mainnet upgrade vote to fix the vulnerability the next day, but subsequently went offline for the following three months. f4lc0n has now disputed the bounty amount and noted that the $50,000 reward has not yet been paid. f4lc0n announced that 10% of future vulnerability bounty earnings will be dedicated to publicly raising awareness of this issue until Injective pays the standard reward.