Let’s break it down.
A self-employed professional charging around $100/hour who spent several days working on the report, communicating with Splinterlands, and following up based on his previous post would probably land somewhere around $2,500 in value (if the actual discovery was a potential big risk). That seems like a fair estimate to me.
The bigger question is: has he actually asked for anything yet? Is there even an open price discussion, or is he making demands?
RE: Zero Day Vulnerability