Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 36.
- Audits since
- 6, the latest dated 2 Jul 2026.
1inch Network security record
As of 29 Oct 2026, 1inch Network has 42 audit reports by 13 security firms on Trustblock; the latest is by Hexens, dated 2 Jul 2026. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain and 1 incident (latest 6 Mar 2025).
Critical findings
2 open critical findings
Reported in “1inch Liquidity Protocol” by Consensys, Dec 2020. Not marked fixed in that report. See the findings
Incident
Incident 6 Mar 2025
Source: De.Fi incident database. 6 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits42
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fusion | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| 1inch Sol security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Cross Chain Swaps Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Settlement Refactor Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order and Aggregation Protocols Diff A | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Protocol Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Aggregation Protocol Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Settlement Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Fusion V2 audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Cross Chain Swaps audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Settlement Phase II audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Settlement audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fusion v1 | Security firm: OXORIO | Date: | Scope: Repository at commit f975e2e | No open critical findings | Open · audits.oxor.io |
| 1inch – Limit Order | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch – Delegation | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch – ERC20 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch Aggregation Router V5 audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| 1inch Smart Contract Review (2nd iteration) | Security firm: Zokyo | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| 1inch Exchange AggregationRouter V5 | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
Findings474
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 5 |
| High | 3 | 19 | 22 |
| Medium | 17 | 29 | 43 |
| Low | 50 | 136 | 148 |
Critical[Out of Scope] ReferralFeeReceiver - anyone can steal all the funds that belong to ReferralFeeReceiverOpen
The report gives no description here.
CriticalGovernanceMothership - notifyFor allows to arbitrarily create new or override other users stake in governance modulesOpen
The report gives no description here.
HighECDSA library has a vulnerability for signature malleability of EIP-2098 compact signatures1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportHighMalicious maker can take more takers funds than taker expected1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportHighUnauthorized withdrawalOpen
The report gives no description here.
MediumUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Open
The report gives no description here.
Open the reportMediumECDSA incorrect size provided for calldata in the static call1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportMediumEthereum reimbursements sent to an incorrect address1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportMediumInvalidating users orders1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportMediumRe-entrancy risk in UniERC201inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportShow 10 more
Medium[M01] Static arguments passed after dynamic argumentsOpen
The report gives no description here.
MediumInexistent Input SanitizationOpen
The `src` and `dst` arguments of the `swapFor` function are not guaranteed to be equal to the supported tokens of the exchange. While `_doTransfers` will simply yield 0 for the `confirmed` variable on unsupported tokens, this can lead to incorrect reward minting on `_mintRewards` as the confirmed balance is simply utilized during reward calculation
MediumMooniswap pairs cannot be unpausedOpen
The report gives no description here.
MediumMooniswapGovernance - _beforeTokenTransfer should not update voting power on transfers to selfOpen
The report gives no description here.
MediumMooniswapGovernance - votingpower is not accurately reflected when minting pool tokensOpen
The report gives no description here.
MediumPausable contract not externally unpausableOpen
The `_unpause` function in the `Pausable` contract is not exposed, meaning that an accidental invocation of the `pause` function is irreversible.
MediumPotential token decimals mismatchOpen
The report gives no description here.
MediumThe uniTransferFrom function can potentially be used with invalid paramsOpen
The report gives no description here.
MediumUnhandled division by zero - Zero and negative inputAmount is not handled before math operations.Open
The report gives no description here.
MediumUnpredictable behavior for users due to admin front running or general bad timingOpen
The report gives no description here.
Show 10 more
MediumUntitled findingOpen
The report gives no description here.
MediumUsers can “increase” their voting power by voting for the max/min valuesOpen
The report gives no description here.
LowLow Granularity of Voting Threshold1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Open
The report gives no description here.
Open the reportLowConsistency on Zero Amount Transfers1inch – Delegation · ChainSecurity · 19 Dec 2022Open
The report gives no description here.
Open the reportLowNo Documentation1inch – ERC20 · ChainSecurity · 19 Dec 2022Open
The report gives no description here.
Open the reportLowUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Open
The report gives no description here.
Open the reportLow_WETH private constant address in UnoswapRouter makes for tricky deployments to other chains1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLowOrder book slippage1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLowOrder cancellation event spam in orderMixin1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLowReentrancy potential issue for contracts building on top RFQOrderMixin1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportShow 10 more
LowSelfdestruct may be removed as an opcode in future1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLow[L01] Transfer may failOpen
The report gives no description here.
Low[L02] Incomplete event emissionsOpen
The report gives no description here.
Low[L02] Malicious parties could prevent the execution of permitable ordersOpen
The report gives no description here.
Low[L03] Duplicated codeOpen
The report gives no description here.
Low[L03] Lack of input validationOpen
The report gives no description here.
Low[L05] Errors and omissions in eventsOpen
The report gives no description here.
Low[L05] Misleading or incomplete inline documentationOpen
The report gives no description here.
Low[L06] No accessible coverage reportOpen
The report gives no description here.
Low[L07] Potentially unsafe unchecked mathOpen
The report gives no description here.
Show 10 more
Low[L09] Low unit test coverageOpen
The report gives no description here.
Low[L09] Withdrawal process could result in flooringOpen
The report gives no description here.
Low[L10] Misleading or incomplete inline documentationOpen
The report gives no description here.
Low[L11] DoS orders possible when using hooksOpen
The report gives no description here.
Low[L12] Rounding can be unfavorable for takerOpen
The report gives no description here.
Low`require` to `modifier`Open
The linked `require` statements could instead be coded in a small `internal` or `private` function that is invoked by a corresponding `modifier` to reduce the gas footprint of the contract.
LowAssembly-based OptimizationOpen
The linked code block creates a new in-memory `bytes` array and assigns each byte sequentially to it via a loop from the `data` array
LowBabylonian Method OptimizationOpen
The linked Babylonian Square Root implementation can be further optimized by omitting the final `else` block as Solidity returns zeroed out values by default regardless of whether the return variable has been explicitly named or not. Additionally, we highly advise that the new, more optimized Babylonian Method from ABDK Consulting is evaluated as an optimized alternative which has already been integrated in Uniswap.
LowCode duplicityOpen
The report gives no description here.
LowConsider using specific contract types in event declarations instead of address ✓ Fix UnverifiedOpen
The report gives no description here.
Show 10 more
LowContract owner can only rescue funds for themselfOpen
The `rescueFunds` function allows the owner of the contract to transfer an arbitrary amount from an arbitrary IERC20 token to themself in order to retrieve funds accidentally sent to it: ```solidity function rescueFunds(IERC20 token, uint256 amount) external onlyOwner { token.uniTransfer(msg.sender, amount); } ```
LowDiscounted swap can be performed while pausedOpen
The discountedSwap function in the OneInchExchange contract does not incorporate the whenNotPaused modifier as the swap function does.
LowFee Collectors can not be removedOpen
The report gives no description here.
LowFunction Visibility OptimizationOpen
The linked functions are declared as `external` or `public`, contain array function arguments and are meant to be mostly invoked by external parties.
LowGovernanceMothership - Follow checks-effects-interactionsOpen
The report gives no description here.
LowImprove inline documentation and test coverageOpen
The report gives no description here.
LowLack of EventsOpen
The report gives no description here.
LowLoop OptimizationOpen
The linked code block contains four `for` loops to ultimately conduct all operations necessary on the 2-member `maxAmounts` and `realBalances` arrays.
LowMidway Condition EvaluationOpen
The linked `require` statements ensure that the `maxAmounts` provided to the contract at the start are greater-than ( `>` ) zero, yet they are evaluated mid-way through.
LowNon-optimal flags storage typeOpen
The `flags` variable could be reduced in size to be tight-packed with the address declaration that follows it by setting its size to `uint96` permitting 96 different flags. This would reduce the total storage cost of the `SwapDescription` to 7 from 8 if we do not factor in the `permit` variable.
Show 10 more
LowNotes and considerations about the Governance DesignOpen
The report gives no description here.
LowRedundant Function ImplementationOpen
The function `_toHex` is implemented twice utilizing function overloading, however the middleware implementation accepting an `address` argument is only used once.
LowRedundant NestingOpen
The `vote` library is meant to be utilized on Data structs that contain only a single `uint256` value.
LowSWC-103 Floating pragmaOpen
The report gives no description here.
LowThe owner can borrow token0/token1 in the rescueFundsOpen
The report gives no description here.
LowUnlocked Solidity compiler versionsOpen
An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
LowUnnecessary `else` statement in `uniBalanceOf` imOpen
The `uniBalanceOf` function can skip the `else`-block implementation and directly return the specific value after the `if`-condition is not me
LowUnspecific compiler version pragmaOpen
The report gives no description here.
LowUnused ContractsOpen
The report gives no description here.
LowUsage of if-revert pattern over requireOpen
The `swap` function in the `OneInchExchange` contract contains the usage of the if-revert pattern over using a require clause, which may be deprecated in the future: ```solidity if (!desc.flags.isDiscountChi()) { revert(RevertReasonParser.parse(reason, "Swap failed: ")); } ```
Show 2 more
LowUse of hardcoded gas limits can be problematicOpen
The report gives no description here.
LowVote - Integer Overflow can be used to force the internal default stateOpen
The report gives no description here.
Incidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts1
| Address | Chain | Source code |
|---|---|---|
| 0x111111111117dc0aa78b770fa6a738034120c302 | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="1inch"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us