1inch Exchange AggregationRouter V5

Off-Chain (Private)

Audited on 2022/07/31

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with 1inch to review AggregationRouter V5. The review was conducted over two weeks, from August 15 2022 to September 16 2022 by Chingiz Mardanov and George Kobakhidze. A total of 40 person-days were spent. Scope Our review focused on the following repositories and commit hashes: https://github.com/1inch/1inch-contract @ 3461c75d00481d111f0323d7e1cb6e56b0dc7ec0, https://github.com/1inch/limit-order-protocol @ 403be0f583b863b3b13373c23e8f2652f5ef720d, https://github.com/1inch/solidity-utils @ 32b04c767db00d4ddc2428534fd6e90abbacb12e. The list of files in scope can be found in the Appendix.

Project

1inch Network

Multi-Chain

Issues (11)

	Low	Medium	High	Critical	Total
Not fixed	5	4	2	-	11
Fixed	-	-	-	-	0
Total	5	4	2	0	11

Contracts (30)

#	File Name
11	1inch-contract/contracts/routers/UnoswapV3Router.sol
12	solidity-utils/contracts/OnlyWethReceiver.sol
13	solidity-utils/contracts/libraries/SafeERC20.sol
14	limit-order-protocol/contracts/OrderMixin.sol
15	solidity-utils/contracts/interfaces/IDaiLikePermit.sol
16	1inch-contract/contracts/AggregationRouterV5.sol
17	1inch-contract/contracts/interfaces/IUniswapV3SwapCallback.sol
18	solidity-utils/contracts/libraries/UniERC20.sol
19	1inch-contract/contracts/routers/GenericRouter.sol
20	limit-order-protocol/contracts/OrderLib.sol

#	File Name
11	1inch-contract/contracts/routers/UnoswapV3Router.sol
12	solidity-utils/contracts/OnlyWethReceiver.sol
13	solidity-utils/contracts/libraries/SafeERC20.sol
14	limit-order-protocol/contracts/OrderMixin.sol
15	solidity-utils/contracts/interfaces/IDaiLikePermit.sol
16	1inch-contract/contracts/AggregationRouterV5.sol
17	1inch-contract/contracts/interfaces/IUniswapV3SwapCallback.sol
18	solidity-utils/contracts/libraries/UniERC20.sol
19	1inch-contract/contracts/routers/GenericRouter.sol
20	limit-order-protocol/contracts/OrderLib.sol

1inch Exchange AggregationRouter V5

Summary

Issues (11)

ECDSA library has a vulnerability for signature malleability of EIP-2098 compact signaturesnot_fixed/high

Malicious maker can take more takers funds than taker expectednot_fixed/high

ECDSA incorrect size provided for calldata in the static callnot_fixed/medium

Ethereum reimbursements sent to an incorrect addressnot_fixed/medium

Invalidating users ordersnot_fixed/medium

Contracts (30)