Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 36.
- Audits since
- 6, the latest dated 2 Jul 2026.
1inch Network security record
As of 30 Oct 2026, 1inch Network has 42 audit reports by 13 security firms on Trustblock; the latest is by Hexens, dated 2 Jul 2026. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain and 1 incident (latest 6 Mar 2025).
Critical findings
2 open critical findings
Reported in “1inch Liquidity Protocol” by Consensys, Dec 2020. Not marked fixed in that report. See the findings
Incident
Incident 6 Mar 2025
Source: De.Fi incident database. 6 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits42
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| 1inch Smart Contract Review | Security firm: Zokyo | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| 1inch – Farming | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| 1inch Fixed Rate Swap Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch - Limit Order | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Order Mixin audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| 1Inch Limit Order Protocol | Security firm: Pessimistic | Date: | Scope: Files named in the report | No open critical findings | Open · GitHub |
| 1inch Aggregation Router audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fixed Rate Swap | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Protocol audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Exchange Aggregation Protocol v3 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Liquidity Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Original removed |
| 1inch Mooniswap v2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Liquidity Protocol | Security firm: Consensys | Date: | Scope: Files named in the report | 2 open critical findings | Open · diligence.security |
| 1inch Exchange | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Exchange Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1INCH / DEX | Security firm: Hacken | Date: | Scope: 1 address on Ethereum | No open critical findings | Open · hacken.io |
Findings474
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 5 |
| High | 3 | 19 | 22 |
| Medium | 17 | 29 | 43 |
| Low | 50 | 136 | 148 |
Critical[Out of Scope] ReferralFeeReceiver - anyone can steal all the funds that belong to ReferralFeeReceiver1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportCriticalGovernanceMothership - notifyFor allows to arbitrarily create new or override other users stake in governance modules1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportHighECDSA library has a vulnerability for signature malleability of EIP-2098 compact signatures1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportHighMalicious maker can take more takers funds than taker expected1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportHighUnauthorized withdrawal1inch Fixed Rate Swap · Ackee Blockchain Security · 22 Aug 2021Open
The report gives no description here.
Open the reportMediumUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Open
The report gives no description here.
Open the reportMediumECDSA incorrect size provided for calldata in the static call1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportMediumEthereum reimbursements sent to an incorrect address1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportMediumInvalidating users orders1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportMediumRe-entrancy risk in UniERC201inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportShow 10 more
MediumUntitled finding1inch Smart Contract Review · Zokyo · 27 Jun 2022Open
The report gives no description here.
Open the reportMedium[M01] Static arguments passed after dynamic arguments1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportMediumPotential token decimals mismatch1inch Fixed Rate Swap · Ackee Blockchain Security · 22 Aug 2021Open
The report gives no description here.
Open the reportMediumUnhandled division by zero - Zero and negative inputAmount is not handled before math operations.1inch Fixed Rate Swap · Ackee Blockchain Security · 22 Aug 2021Open
The report gives no description here.
Open the reportMediumMooniswap pairs cannot be unpaused1inch Liquidity Protocol Audit · OpenZeppelin · 29 Jan 2021Open
The report gives no description here.
Open the reportMediumInexistent Input Sanitization1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The `src` and `dst` arguments of the `swapFor` function are not guaranteed to be equal to the supported tokens of the exchange. While `_doTransfers` will simply yield 0 for the `confirmed` variable on unsupported tokens, this can lead to incorrect reward minting on `_mintRewards` as the confirmed balance is simply utilized during reward calculation
Open the reportMediumMooniswapGovernance - _beforeTokenTransfer should not update voting power on transfers to self1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportMediumMooniswapGovernance - votingpower is not accurately reflected when minting pool tokens1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportMediumThe uniTransferFrom function can potentially be used with invalid params1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportMediumUnpredictable behavior for users due to admin front running or general bad timing1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportShow 10 more
MediumUsers can “increase” their voting power by voting for the max/min values1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportMediumPausable contract not externally unpausable1inch Exchange · CertiK · 15 Nov 2020Open
The `_unpause` function in the `Pausable` contract is not exposed, meaning that an accidental invocation of the `pause` function is irreversible.
Open the reportLowLow Granularity of Voting Threshold1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Open
The report gives no description here.
Open the reportLowConsistency on Zero Amount Transfers1inch – Delegation · ChainSecurity · 19 Dec 2022Open
The report gives no description here.
Open the reportLowNo Documentation1inch – ERC20 · ChainSecurity · 19 Dec 2022Open
The report gives no description here.
Open the reportLowUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Open
The report gives no description here.
Open the reportLow_WETH private constant address in UnoswapRouter makes for tricky deployments to other chains1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLowOrder book slippage1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLowOrder cancellation event spam in orderMixin1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLowReentrancy potential issue for contracts building on top RFQOrderMixin1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportShow 10 more
LowSelfdestruct may be removed as an opcode in future1inch Exchange AggregationRouter V5 · Consensys · 1 Aug 2022Open
The report gives no description here.
Open the reportLowLack of Events1inch – Farming · ChainSecurity · 29 Mar 2022Open
The report gives no description here.
Open the reportLow[L02] Incomplete event emissions1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Open
The report gives no description here.
Open the reportLow[L03] Lack of input validation1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Open
The report gives no description here.
Open the reportLow[L05] Misleading or incomplete inline documentation1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Open
The report gives no description here.
Open the reportLow[L06] No accessible coverage report1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Open
The report gives no description here.
Open the reportLow[L07] Potentially unsafe unchecked math1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Open
The report gives no description here.
Open the reportLow[L09] Withdrawal process could result in flooring1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Open
The report gives no description here.
Open the reportLow[L02] Malicious parties could prevent the execution of permitable orders1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportLow[L03] Duplicated code1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportShow 10 more
Low[L05] Errors and omissions in events1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportLow[L09] Low unit test coverage1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportLow[L10] Misleading or incomplete inline documentation1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportLow[L11] DoS orders possible when using hooks1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportLow[L12] Rounding can be unfavorable for taker1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Open
The report gives no description here.
Open the reportLowCode duplicity1inch Fixed Rate Swap · Ackee Blockchain Security · 22 Aug 2021Open
The report gives no description here.
Open the reportLowSWC-103 Floating pragma1inch Fixed Rate Swap · Ackee Blockchain Security · 22 Aug 2021Open
The report gives no description here.
Open the reportLowContract owner can only rescue funds for themself1inch Exchange Aggregation Protocol v3 · CertiK · 15 Mar 2021Open
The `rescueFunds` function allows the owner of the contract to transfer an arbitrary amount from an arbitrary IERC20 token to themself in order to retrieve funds accidentally sent to it: ```solidity function rescueFunds(IERC20 token, uint256 amount) external onlyOwner { token.uniTransfer(msg.sender, amount); } ```
Open the reportLowDiscounted swap can be performed while paused1inch Exchange Aggregation Protocol v3 · CertiK · 15 Mar 2021Open
The discountedSwap function in the OneInchExchange contract does not incorporate the whenNotPaused modifier as the swap function does.
Open the reportLowFee Collectors can not be removed1inch Liquidity Protocol Audit · OpenZeppelin · 29 Jan 2021Open
The report gives no description here.
Open the reportShow 10 more
Low`require` to `modifier`1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The linked `require` statements could instead be coded in a small `internal` or `private` function that is invoked by a corresponding `modifier` to reduce the gas footprint of the contract.
Open the reportLowAssembly-based Optimization1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The linked code block creates a new in-memory `bytes` array and assigns each byte sequentially to it via a loop from the `data` array
Open the reportLowBabylonian Method Optimization1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The linked Babylonian Square Root implementation can be further optimized by omitting the final `else` block as Solidity returns zeroed out values by default regardless of whether the return variable has been explicitly named or not. Additionally, we highly advise that the new, more optimized Babylonian Method from ABDK Consulting is evaluated as an optimized alternative which has already been integrated in Uniswap.
Open the reportLowFunction Visibility Optimization1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The linked functions are declared as `external` or `public`, contain array function arguments and are meant to be mostly invoked by external parties.
Open the reportLowLoop Optimization1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The linked code block contains four `for` loops to ultimately conduct all operations necessary on the 2-member `maxAmounts` and `realBalances` arrays.
Open the reportLowMidway Condition Evaluation1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The linked `require` statements ensure that the `maxAmounts` provided to the contract at the start are greater-than ( `>` ) zero, yet they are evaluated mid-way through.
Open the reportLowRedundant Function Implementation1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The function `_toHex` is implemented twice utilizing function overloading, however the middleware implementation accepting an `address` argument is only used once.
Open the reportLowRedundant Nesting1inch Mooniswap v2 · CertiK · 16 Dec 2020Open
The `vote` library is meant to be utilized on Data structs that contain only a single `uint256` value.
Open the reportLowConsider using specific contract types in event declarations instead of address ✓ Fix Unverified1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportLowGovernanceMothership - Follow checks-effects-interactions1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportShow 10 more
LowImprove inline documentation and test coverage1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportLowNotes and considerations about the Governance Design1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportLowThe owner can borrow token0/token1 in the rescueFunds1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportLowUnspecific compiler version pragma1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportLowUse of hardcoded gas limits can be problematic1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportLowVote - Integer Overflow can be used to force the internal default state1inch Liquidity Protocol · Consensys · 1 Dec 2020Open
The report gives no description here.
Open the reportLowNon-optimal flags storage type1inch Exchange · CertiK · 15 Nov 2020Open
The `flags` variable could be reduced in size to be tight-packed with the address declaration that follows it by setting its size to `uint96` permitting 96 different flags. This would reduce the total storage cost of the `SwapDescription` to 7 from 8 if we do not factor in the `permit` variable.
Open the reportLowUnlocked Solidity compiler versions1inch Exchange · CertiK · 15 Nov 2020Open
An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
Open the reportLowUnnecessary `else` statement in `uniBalanceOf` im1inch Exchange · CertiK · 15 Nov 2020Open
The `uniBalanceOf` function can skip the `else`-block implementation and directly return the specific value after the `if`-condition is not me
Open the reportLowUsage of if-revert pattern over require1inch Exchange · CertiK · 15 Nov 2020Open
The `swap` function in the `OneInchExchange` contract contains the usage of the if-revert pattern over using a require clause, which may be deprecated in the future: ```solidity if (!desc.flags.isDiscountChi()) { revert(RevertReasonParser.parse(reason, "Swap failed: ")); } ```
Open the reportShow 2 more
Low[L01] Transfer may fail1inch Exchange Audit · OpenZeppelin · 13 Nov 2020Open
The report gives no description here.
Open the reportLowUnused Contracts1INCH / DEX · Hacken · 5 Nov 2020Open
The report gives no description here.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts1
| Address | Chain | Source code |
|---|---|---|
| 0x111111111117dc0aa78b770fa6a738034120c302 | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="1inch"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us