1inch Exchange Aggregation Protocol v3

CertiK15 Mar 2021Files named in the report

CertiK reviewed 1inch Network (1inch Exchange Aggregation Protocol v3) on 15 Mar 2021: 2 findings, 0 critical; none marked fixed.

No open critical findings

Open the report Open 1inch Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	2	0	0

LowContract owner can only rescue funds for themselfOpen

The `rescueFunds` function allows the owner of the contract to transfer an arbitrary amount from an arbitrary IERC20 token to themself in order to retrieve funds accidentally sent to it: ```solidity function rescueFunds(IERC20 token, uint256 amount) external onlyOwner { token.uniTransfer(msg.sender, amount); } ```

LowDiscounted swap can be performed while pausedOpen

The discountedSwap function in the OneInchExchange contract does not incorporate the whenNotPaused modifier as the swap function does.