Everyone has a story about a friend who sold a vuln for X. At least one case though has been documented in an academic paper by a well respected researcher [1]. (That would put the cheque at < 10%)

[1] http://weis2007.econinfosec.org/papers/29.pdf