I don't know shit about legality, but that seem s off just from the wording
I can see a lot of dishonesty on Nintendo's part here:
Legal
1 - "You agree that you will not violate any law, or disrupt or compromise any data that is not your own in connection with reporting vulnerability information to Nintendo".
> Fair enough.
2 - Nintendo reserves the right to modify the terms of this program at any time.
> "This Program" - Very loose terming here, what exactly are they referring to? The Reward? The Software/Coding provided by Bounty Hunters? Everything Perhaps??
3 - "You have no obligation to provide Nintendo with the above mentioned security and vulnerability information. However, you agree that by submitting such information to Nintendo, even if the information is not eligible for a reward, you grant Nintendo a worldwide, perpetual, irrevocable, non-exclusive, transferable, sublicenseable, fully-paid and royalty-free license under any and all intellectual property rights that you own or control to use, copy, modify, create derivative works based upon and otherwise exploit such information for any purpose".
> So, from my interpretation, it seems that they are saying that even if you provide them with information/help regarding exploits or anything along the lines of system vulnerabilities - you still do not have to do so in the first place. BUT, if you do, whatever you provide for us will become completely owned by us, and we might not even reward you as a result (lololol).
Very suspicious indeed. $20,000 is NOTHING compared to the risk involved here, and the relative profit Nintendo will make if this truly fosters their security.