davout did you see a real result of the "exploit"? Yes or No?
I will say that while this may revolt you.......
You should pay DAVOUT for the work he has done even though you did not contract with him. You might want to hire him for FURTHER work checking out your site (if he is interested/willing to do so).
I love the idea of an additional exchange, the more the better. But we need them to be secure. It is not just about the fees.
I reported the exploit and posted the POC.
No, I won't work for them. I don't need that on my rep. If they want to give me BTC, that'd be great.