Is it legal to start an auction to sell an exploit, never close on it, then use that as the price point to negotiate a bounty?