And leaving the exploits in the wild for weeks/months beforehand.

To mitigate this problem, Google has recently announced that they are running a similar program year-round:

http://blog.chromium.org/2015/02/pwnium-v-never-ending-pwniu...

With very lower rewards, the exploit that nettet $110k would probably be getting less than $50k

But you also minimize the risk that someone else will find and report the vulnerability before you do, negating any & all chance of earning a bounty yourself.

This is a valid criticism.

Perhaps more worrying, they may have sold them elsewhere first and informed the purchaser that they have until the competition date to use it. Better business if you have to come back after the disclosure date for more holes...

Nohig ethical at all going on here.

My understanding is that would violate the rules of the competition. Though of course if a competitor were to do that, odds are no one would find out.

Would someone willing to sell exploits on the black market really be concerned with "violating the rules of the competition"?

Well, presumably they'd want to keep the money from the competition. That's definitely an incentive.

I would imagine it'd be fairly hard to the competition to know and revoke the money. Bad guys are almost certainly exploiting various undisclosed vulnerabilities. The bigger issue, I'd assume, is that by doing this competition, you've now killed that bug you previously sold. So long that was disclosed to the buyer though, I imagine you're all set.

Odds are the black market guys find out. I don't know how the market works, but I'd be pretty pissed if I had bought a hole just for it to be patched soon after.