What would you guess the going rate on the black market would be for an RCE on some error-log collection box that happens to be in use by Facebook? My guess is "less than $5000".
The only code they executed was "sleep(100)" If they started dumping env variables/snooping around they would have done a lot more than $5000 worth of damage.
He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server is... and even then, much more work would be required for the attacker (more than an average vuln buyer is probably capable of).
Not to mention this way he can actually report it on his taxes and get the money plopped straight into his bank account, whereas black market is a hell of a lot more uncertain if you even get paid.
