[yvoschaap2]

Yes, 4,5k is decent. But put that in perspective of type of data and content Facebook exposed of its billion users.

And personally if Facebook's says "no maximum reward" (https://www.facebook.com/whitehat) I was expecting something different for a complete account access exploit.

[ceejayoz]

The $4.5k is intended as a "thank you" card, not a paycheck.

[msellout]

Perhaps they didn't think it could be weaponized, so to speak. Accessing one account at a time isn't as big a deal as systematically accessing many accounts. Even if your exploit could do so, they may have safeguards against such robotic access.