1inch Exchange AggregationRouter V5

Off-Chain (Private)

Audited on 2022/07/31

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with 1inch to review AggregationRouter V5. The review was conducted over two weeks, from August 15 2022 to September 16 2022 by Chingiz Mardanov and George Kobakhidze. A total of 40 person-days were spent. Scope Our review focused on the following repositories and commit hashes: https://github.com/1inch/1inch-contract @ 3461c75d00481d111f0323d7e1cb6e56b0dc7ec0, https://github.com/1inch/limit-order-protocol @ 403be0f583b863b3b13373c23e8f2652f5ef720d, https://github.com/1inch/solidity-utils @ 32b04c767db00d4ddc2428534fd6e90abbacb12e. The list of files in scope can be found in the Appendix.

Project

1inch Network

Multi-Chain

Issues (11)

	Low	Medium	High	Critical	Total
Not fixed	5	4	2	-	11
Fixed	-	-	-	-	0
Total	5	4	2	0	11

Contracts (30)

#	File Name
21	limit-order-protocol/contracts/helpers/PredicateHelper.sol
22	solidity-utils/contracts/EthReceiver.sol
23	1inch-contract/contracts/interfaces/IAggregationExecutor.sol
24	limit-order-protocol/contracts/OrderRFQMixin.sol
25	solidity-utils/contracts/libraries/StringUtil.sol
26	solidity-utils/contracts/libraries/ECDSA.sol
27	1inch-contract/contracts/interfaces/IUniswapV3Pool.sol
28	limit-order-protocol/contracts/OrderRFQLib.sol
29	limit-order-protocol/contracts/helpers/NonceManager.sol
30	solidity-utils/contracts/libraries/RevertReasonForwarder.sol

#	File Name
21	limit-order-protocol/contracts/helpers/PredicateHelper.sol
22	solidity-utils/contracts/EthReceiver.sol
23	1inch-contract/contracts/interfaces/IAggregationExecutor.sol
24	limit-order-protocol/contracts/OrderRFQMixin.sol
25	solidity-utils/contracts/libraries/StringUtil.sol
26	solidity-utils/contracts/libraries/ECDSA.sol
27	1inch-contract/contracts/interfaces/IUniswapV3Pool.sol
28	limit-order-protocol/contracts/OrderRFQLib.sol
29	limit-order-protocol/contracts/helpers/NonceManager.sol
30	solidity-utils/contracts/libraries/RevertReasonForwarder.sol

1inch Exchange AggregationRouter V5

Summary

Issues (11)

ECDSA library has a vulnerability for signature malleability of EIP-2098 compact signaturesnot_fixed/high

Malicious maker can take more takers funds than taker expectednot_fixed/high

ECDSA incorrect size provided for calldata in the static callnot_fixed/medium

Ethereum reimbursements sent to an incorrect addressnot_fixed/medium

Invalidating users ordersnot_fixed/medium

Contracts (30)