1inch Mooniswap v2

CertiKFiles named in the report

CertiK reviewed 1inch Network (1inch Mooniswap v2) on 16 Dec 2020: 36 findings, 0 critical; 27 marked fixed, 9 open.

No open critical findings
Open the reportOpen 1inch Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings36

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium102
Low8025
MediumInexistent Input SanitizationOpen

The `src` and `dst` arguments of the `swapFor` function are not guaranteed to be equal to the supported tokens of the exchange. While `_doTransfers` will simply yield 0 for the `confirmed` variable on unsupported tokens, this can lead to incorrect reward minting on `_mintRewards` as the confirmed balance is simply utilized during reward calculation

Low`require` to `modifier`Open

The linked `require` statements could instead be coded in a small `internal` or `private` function that is invoked by a corresponding `modifier` to reduce the gas footprint of the contract.

LowAssembly-based OptimizationOpen

The linked code block creates a new in-memory `bytes` array and assigns each byte sequentially to it via a loop from the `data` array

LowBabylonian Method OptimizationOpen

The linked Babylonian Square Root implementation can be further optimized by omitting the final `else` block as Solidity returns zeroed out values by default regardless of whether the return variable has been explicitly named or not. Additionally, we highly advise that the new, more optimized Babylonian Method from ABDK Consulting is evaluated as an optimized alternative which has already been integrated in Uniswap.

LowFunction Visibility OptimizationOpen

The linked functions are declared as `external` or `public`, contain array function arguments and are meant to be mostly invoked by external parties.

LowLoop OptimizationOpen

The linked code block contains four `for` loops to ultimately conduct all operations necessary on the 2-member `maxAmounts` and `realBalances` arrays.

LowMidway Condition EvaluationOpen

The linked `require` statements ensure that the `maxAmounts` provided to the contract at the start are greater-than ( `>` ) zero, yet they are evaluated mid-way through.

LowRedundant Function ImplementationOpen

The function `_toHex` is implemented twice utilizing function overloading, however the middleware implementation accepting an `address` argument is only used once.

LowRedundant NestingOpen

The `vote` library is meant to be utilized on Data structs that contain only a single `uint256` value.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (23)

  • contracts/interfaces/IMooniswapFactoryGovernance.sol
  • contracts/MooniswapFactory.sol
  • contracts/MooniswapDeployer.sol
  • contracts/governance/GovernanceFeeReceiver.sol
  • contracts/libraries/Sqrt.sol
  • contracts/libraries/VirtualBalance.sol
  • contracts/utils/Converter.sol
  • contracts/libraries/LiquidVoting.sol
  • contracts/libraries/Vote.sol
  • contracts/governance/BaseGovernanceModule.sol
  • contracts/governance/rewards/RewardDistributionRecipient.sol
  • contracts/governance/rewards/Rewards.sol
  • contracts/governance/MooniswapGovernance.sol
  • contracts/interfaces/IGovernanceModule.sol
  • contracts/libraries/UniERC20.sol
  • contracts/inch/GovernanceMothership.sol
  • contracts/utils/BalanceAccounting.sol
  • contracts/interfaces/IMooniswapDeployer.sol
  • contracts/Mooniswap.sol
  • contracts/governance/MooniswapFactoryGovernance.sol
  • contracts/MooniswapConstants.sol
  • contracts/interfaces/IReferralFeeReceiver.sol
  • contracts/interfaces/IMooniswapFactory.sol

Part of 1inch Network’s security record

1inch Network
Audits42 audits by 13 firmsLast audit Jul 2026, by Hexens.
Critical findings2 open critical findingsReported in “1inch Liquidity Protocol” by Consensys, Dec 2020. Not marked fixed in that report.
IncidentIncident 6 Mar 2025Source: De.Fi incident database.
Open 1inch Network’s security record

Security firm

CertiK

1,044 projects reviewed · 1,393 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us