Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 36.
- Audits since
- 6, the latest dated 2 Jul 2026.
1inch Network security record
As of 30 Oct 2026, 1inch Network has 42 audit reports by 13 security firms on Trustblock; the latest is by Hexens, dated 2 Jul 2026. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain and 1 incident (latest 6 Mar 2025).
Critical findings
2 open critical findings
Reported in “1inch Liquidity Protocol” by Consensys, Dec 2020. Not marked fixed in that report. See the findings
Incident
Incident 6 Mar 2025
Source: De.Fi incident database. 6 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits42
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| 1inch Smart Contract Review | Security firm: Zokyo | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| 1inch – Farming | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| 1inch Fixed Rate Swap Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch - Limit Order | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Order Mixin audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| 1Inch Limit Order Protocol | Security firm: Pessimistic | Date: | Scope: Files named in the report | No open critical findings | Open · GitHub |
| 1inch Aggregation Router audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fixed Rate Swap | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Protocol audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Exchange Aggregation Protocol v3 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Liquidity Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Original removed |
| 1inch Mooniswap v2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Liquidity Protocol | Security firm: Consensys | Date: | Scope: Files named in the report | 2 open critical findings | Open · diligence.security |
| 1inch Exchange | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| 1inch Exchange Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1INCH / DEX | Security firm: Hacken | Date: | Scope: 1 address on Ethereum | No open critical findings | Open · hacken.io |
Findings474
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 5 |
| High | 3 | 19 | 22 |
| Medium | 17 | 29 | 43 |
| Low | 50 | 136 | 148 |
CriticalGriefing Attack via Missing timelocks and mint in Escrow PDA Seeds on Destination Chain1inch Crosschain security review · Hexens · 5 Aug 2025Fixed
The report gives no description here.
Open the reportCriticalOrder fulfillment can be front-ran to steal from taker using reinitialization1inch Sol security review · Hexens · 21 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportCriticalUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportCriticalUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportHighOrder Forgery via Reused PDA Seeds Could Lead to Fund Theft1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportHighThe create_escrow function sets an incorrect token amount in the escrow data1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportHighThe later “calldataload” opcode is redundant, as the action point bump was already read by the former “calldataload”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportHighSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportHighUnclear behavior in VotingPowerCalculator.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
HighThere is no value for feeReceiver in the constructor in St1Inch1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportHighPod.updateBalances() Cannot Transfer ERC20Pods1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportHighPossible Frontrunning on Registration1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Fixed
The report gives no description here.
Open the reportShow 10 more
HighGenericRouter.sol: function _swap(), line 165.1inch Smart Contract Review · Zokyo · 27 Jun 2022Fixed
The report gives no description here.
Open the reportHighGas Griefing1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportHigh[H01] Inconsistent data passed into _makeCall1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportHigh[H02] Partially-filled private orders can be filled by anyone1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportHigh[H03] Malicious maker could take advantage of partial fills to steal taker’s assets1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportHighThe `_callGetter()` Function Can Return Incorrect1inch - Limit Order · CertiK · 25 Nov 2021Fixed
The `_callGetter()` function on line 330 is meant to return a `makerAmount` when given `takerAmount` data and similarly return a `takerAmount` when given `makerAmount` data. However, if `getter.length == 0`, it actually returns an amount that is of the same type as the input. ```solidity=330 function _callGetter(bytes memory getter, uint256 orderAmount, uint256 amount) private view returns(uint256) { if (getter.length == 0) { // On empty getter calldata only exact amount is allowed require(amount == orderAmount, "LOP: wrong amount"); return orderAmount; ```
Open the reportHighUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportMediumAmount-in fee wrapper can override SplineSwap exact-in partial fill1inch security review · Hexens · 2 Jul 2026Fixed
The report gives no description here.
Open the reportMediumAn attacker can pre-create the ATA before the escrow or order is initialized to cause a DoS in escrow creation1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportMediumConsider Paying Fees in the Native Sol Token when the `native_dst_asset` Flag Is Set1inch Fusion · Quantstamp · 24 Mar 2025Fixed
The protocol allows the maker to set the `native_dst_asset` flag during order creation to indicate that they want to receive the native SOL token in exchange for their source tokens. The `fill()` function considers this flag when paying out to the maker; however, it does not do the same for the protocol fee. This means the protocol fee will always be in the destination token, regardless of `native_dst_asset`. This can create issues since, when a maker sets this flag, they might not provide proper values for the destination token account.
Open the reportShow 10 more
MediumForged Event Emission1inch Limit Order Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportMediumFee Regulation Might Not Work as Expected on Non-Mainnet Chains1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportMediumNo Masking of Addresses in SafeERC20 Library1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect modifier used1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportMediumInteger overflow in TimelocksLib1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that ”addressPtr” calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that ”addressPtr” calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that calldata offset calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that calldata offset calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no length check for “details”, so here data before “details” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumThere is no length check for “details”, so here data before “details” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no length check for “details”, so here data before “details” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no length check for “interaction”, so here data before “interaction” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumUnderflow is possible here.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumOverflow/Underflow in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumOverflow/Underflow in VotingPowerCalculator.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumProcedural in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumUnclear behavior in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumUnclear behavior in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumfeeReceiver can be zero address in St1Inch1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumThere is no validation of promoted addresses in WhitelistRegistry1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportMediumThere is no validation that Pod has a valid token in ERC20Pods.1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportMediumAllowances Not Completely Disabled1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportMediumSt1inch Can Be Locked Indefinitely1inch – Limit Order · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMedium[M01] Lack of output safeguards could lead to loss of funds1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Fixed
The report gives no description here.
Open the reportShow 10 more
Medium[M02] ERC721 orders can be manipulated1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportMedium[M03] Undocumented decimal assumptions1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportMediumIncorrect Variable Used1inch - Limit Order · CertiK · 25 Nov 2021Fixed
In the function `fillOrderTo()`, the function makes a call to `order.makerAsset`. ```solidity=273 _makeCall( order.makerAsset, abi.encodePacked( IERC20.transferFrom.selector, uint256(uint160(order.maker)), uint256(uint160(target)), makingAmount, order.makerAsset ) ); ``` However, if we understood the `Order` struct correctly, the `order.makerAsset` at the end of the `abi.encodePacked` should instead be `order.makerAssetData`.
Open the reportMediumUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportMediumIncorrect Stake Notification Implementation1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The `notifyFor` function is meant to be used to allow any address to force a status update of another `address` arbitrarily to ensure the stakes states are kept in sync. However, the second argument passed to the `_notifyFor` function is the balance of the `msg.sender` instead of the account to-be-notified, causing an incorrect balance to be reported for it and potentially for as many accounts as a particular `msg.sender` wants.
Open the reportMediumInexistent Input Sanitization of Mooniswap Addres1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked code blocks link to function implementations within `ReferralFeeReceiver` that do not conduct any sanitization on the input `mooniswap` variable and invoke functions on it.
Open the reportMedium[M01] Cannot unpause exchange1inch Exchange Audit · OpenZeppelin · 13 Nov 2020Fixed
The report gives no description here.
Open the reportMedium[M02] Cannot decrease allowance to non-zero value1inch Exchange Audit · OpenZeppelin · 13 Nov 2020Fixed
The report gives no description here.
Open the reportMedium[M03] Incorrect safeApprove usage1inch Exchange Audit · OpenZeppelin · 13 Nov 2020Fixed
The report gives no description here.
Open the reportShow 10 more
LowOne-Sided SplineSwap Orders Are Non-Functional1inch security review · Hexens · 2 Jul 2026Fixed
The report gives no description here.
Open the reportLowTaker Can Extract a Small Amount of Base Tokens with Zero Quote Input1inch security review · Hexens · 2 Jul 2026Fixed
The report gives no description here.
Open the reportLowBidirectional PeggedSwap normalization mismatch in asymmetric configurations1inch security review · Hexens · 9 Mar 2026Fixed
The report gives no description here.
Open the reportLowMissing validation of the mint account in the PublicCancelEscrow context1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportLowIncomplete DocstringsCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowLack of Sensitive Event EmissionCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowMissing DocstringsCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowpublicWithdraw Can Happen During CancellationCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowExternal Calls Have a Hard-Coded Gas Limit1inch Limit Order Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportLowIncomplete Interface1inch Limit Order Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowAssembly Block Diverges from Solidity's Memory Model1inch Aggregation Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportLowRestricted External Calls Can Be Made on Behalf of AggregationRouter1inch Aggregation Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportLowDiscrepancy Between Proposal and Implementation1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportLowLack of Input Parameter Validation1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportLowTokens can be sweeped from FeeTaker1inch Fusion V2 audit · Decurity · 2 Apr 2024Fixed
The report gives no description here.
Open the reportLowLack of event emitting1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportLowMaker can withdraw from EscrowDst1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportLow_CURFE() ALLOWS ANY FUNCTION SELECTOR FOR AN EXTERNAL CALL1inch security review · Hexens · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowWETH CASE SHOULD BE HANDLED BY CLIPPEREXCHANGE.SWAP()1inch security review · Hexens · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in FusionDetails.sol1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowThe condition “interaction.length < 20” condition is always true as otherwise slicing would fail.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in FeeBankCharger.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in Pod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in Pod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in VotingPowerCalculator.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowBad naming in IDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in IFeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in IFeeBankCharger.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowDocumentation in BasicDelegationPodWith-1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowDocumentation in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowReadability in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowReadability in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowReadability in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in IERC20Pods.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowThe _DEFAULT_INITIAL_RATE_BUMP and _DEFAULT_DURATION constants are not used in Settlement1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportLowThere is no validation of constructor parameters in FeeBank1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportLowBroken C-E-I Pattern1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowERC20Pods podsLimit Sanitization1inch – ERC20 · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowInconsistency and Zero Address Check on register()1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowMissing Events1inch – ERC20 · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowNo Event upon Registering Delegatee1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowOperations Order on Pod Removal1inch – ERC20 · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowResolver Can Set Arbitrary Callback1inch – Limit Order · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowCommented Code1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowfarmingCheckpoint() Has No Functionality1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowFarms Rely on Token to Checkpoint1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowGas Inefficiencies1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowIneffective period Check1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowIntroduction of Batched Operations1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLowUsage as a Library1inch – Farming · ChainSecurity · 29 Mar 2022Fixed
The report gives no description here.
Open the reportLow[L01] Deposit can revert on underflow1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Fixed
The report gives no description here.
Open the reportLow[L04] Constants not declared or clearly named1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Fixed
The report gives no description here.
Open the reportLow[L08] Unsafe explicit casting of integers1inch Fixed Rate Swap Audit · OpenZeppelin · 15 Feb 2022Fixed
The report gives no description here.
Open the reportLow[L01] Constants not declared explicitly1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportLow[L04] Erroneous or misleading test suite1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportShow 10 more
Low[L06] Storage changes during event emission1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportLow[L07] Inconsistent decoding methodologies could cause outcome discrepancies1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportLow[L08] Lack of input validation1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportLow[L13] Contradictory order handling when lacking parameters1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportLow[L14] Using deprecated Chainlink calls1inch Limit Order Protocol Audit · OpenZeppelin · 16 Dec 2021Fixed
The report gives no description here.
Open the reportLowFunctionality of `decodeBool()`1inch - Limit Order · CertiK · 25 Nov 2021Fixed
The `decodeBool()` function does not check if the bytes input is 0 or 1, but rather if it is non-zero. Any non-zero data will be decoded into `true`.
Open the reportLowGas Inefficiency of Validation1inch - Limit Order · CertiK · 25 Nov 2021Fixed
In the function `fillOrderRFQTo()`, the function checks whether the order is valid near the end of the function call. ```solidity=139 require(order.allowedSender == address(0) || order.allowedSender == msg.sender, "LOP: private order"); bytes32 orderHash = _hashTypedDataV4(keccak256(abi.encode(LIMIT_ORDER_RFQ_TYPEHASH, order))); require(SignatureChecker.isValidSignatureNow(maker, orderHash, signature), "LOP: bad signature"); ``` It might be more optimal to locate these checks at the start of the function call so extraneous calculations are not performed.
Open the reportLowMissing Emit Events1inch - Limit Order · CertiK · 25 Nov 2021Fixed
The following function affects the status of sensitive variables and should be able to emit events as notifications: - `OrderRFQMixin.cancelOrderRFQ()` to cancel an RFQ order.
Open the reportLowMisspelled Error Message1inch - Limit Order · CertiK · 25 Nov 2021Fixed
One of the error messages in the function `fillOrderTo()` is misspelled. ```solidity=202 require(remainingMakerAmount != 1, "LOP: remaining amoint is 0"); ``` The error message should instead be "LOP: remaining amount is 0".
Open the reportLowUsers May Lose Money on Partial Order Fills1inch - Limit Order · CertiK · 25 Nov 2021Fixed
The `getMakerAmount()` function gives the floor of `swapTakerAmount * orderMakerAmount / orderTakerAmount`, while `getTakerAmount()` gives the ceiling of `swapMakerAmount * orderTakerAmount / orderMakerAmount`. For users that partially fill orders with small amounts, they may potentially lose money. For example, suppose `orderMakerAmount = 10` and `orderTakerAmount = 3`, so the ratio between maker tokens and taker tokens is 10:3. If a user planned to exchange 1 taker token, then they would receive `getMakerAmount(10,3,1) = 3` maker tokens, due to a floor rounding, resulting in a loss of 0.33 maker tokens. If a user instead wished to obtain 1 maker token, then they would have to pay `getTakerAmount(10,3,1) = 1` taker token, due to the ceiling rounding, resulting in an overpay of 0.7 taker tokens.
Open the reportShow 10 more
LowUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Order Mixin audit · ABDK Consulting · 12 Nov 2021Fixed
The report gives no description here.
Open the reportLowCode quality1Inch Limit Order Protocol · Pessimistic · 1 Nov 2021Fixed
In OrderMixin contract, result.length is checked to be greater than 0 in: - simulateCalls() function at line 115. - _makeCall() function at line 285. We recommend verifying that result.length is not less than 32 before decoding it to bool variable.
Open the reportLowCode quality1Inch Limit Order Protocol · Pessimistic · 1 Nov 2021Fixed
The report gives no description here.
Open the reportLowCode quality1Inch Limit Order Protocol · Pessimistic · 1 Nov 2021Fixed
The report gives no description here.
Open the reportLowCode quality1Inch Limit Order Protocol · Pessimistic · 1 Nov 2021Fixed
The report gives no description here.
Open the reportShow 10 more
LowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportShow 10 more
LowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router audit · ABDK Consulting · 4 Oct 2021Fixed
The report gives no description here.
Open the reportShow 10 more
Low`require` Consistency1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The project imposes `require` checks on multiple functions, like L255 of `_doTransfers`, to ensure that zero value swaps etc. are prohibited. The `withdrawFor` function fails to impose such a check as it merely ensures that the `value` is greater-than-or-equal to `minReturns[i]` which itself could be `0`.
Open the reportLow`SafeMath` Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked mathematical operations utilize their `SafeMath` counterpart implementation whereas it is completely reudndant for the operations of L31 and L34 as well as potentially redundant for the operation of L30.
Open the reportLow`SafeMath` Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked statement conducts a `SafeMath` subtraction operation on the `_totalSupply` variable based on the amount burned from the `_balances` mapping. As the contract level variables of the contract are `private`, they cannot be altered by derivative implementations and as such, the `_totalSupply` is kept in perfect sync with the amount of total balance held in the `_balances` mapping. As a result, if a `SafeMath` subtraction operation succeeds on the _balances mapping it is guaranteed to succeed in the `_totalSupply` variable as well, rendering its use redundant gaswise.
Open the reportLow`SafeMath` Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked statements all conduct `SafeMath` operations whilst the safety of their operations is guaranteed by the system either via `if-else` clauses or constant variable utilizations
Open the reportLow`SafeMath` Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked statements both contain redundant operations as they are nested within an `if-else` block that guarantees their validity
Open the reportLow`SafeMath` Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked statements conduct `SafeMath` operations when their safety may be guaranteed by the system for the first and last linked statements and is fully guaranteed for the middle statement.
Open the reportLowDisproportionate Initial Minting1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The initial minting process of a Mooniswap appears to be disproportionate in the sense that it does not rely on the initial deposit, meaning that a user can simply deposit only a single unit and acquire a mint equal to `_BASE_SUPPLY.mul(99)` as only a `Math.max` operation is used on L145.
Open the reportLowDocumentation Consistency1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked documentation block is meant to explain the calculations carried out in `_getReturn` , however the variable naming conventions of the function block do not conform to what is laid out in the documentation and the documentation itself appears inconsistent with the statements of the function.
Open the reportLowEvent Indexing1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The `Swapped` event is indexing the source token, however, the destination token remains unindexed
Open the reportLowIncorrect `to` Conditional1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked `_beforeTokenTransfer` hook incorrectly sanitizes burn operations by evaluating whether the `from` instead of the to variable is different than the zero address for the ternary operator used on the balanceTo assignment.
Open the reportShow 10 more
LowIncorrect Implementation / Naming Convention1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The naming convention utilizing `tax` alludes to a tax being imposed on the balances, however L323 assigns the addition instead of the subtraction of the tax from the `srcBalance`.
Open the reportLowIncorrect len Boundry Check1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The boundary check of the `len` variable is meant to ensure that the `len` variable can fit within a single 8-bit slot by ensuring its within its valid range. However, the upper bound specified is incorrect.
Open the reportLowIncorrect Transfer Evaluation1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked code invokes `uniTransferFrom` for an amount equal to `maxAmounts[i]` and consequently assigns that value to `receivedAmounts[i]` even if a token imposes fees on the transaction.
Open the reportLowInexistent Access Control1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked functions are meant to conduct sensitive operations on the contract and utilize its full balance to conduct a swap. Even though the target of a given `swap` operation will always be the `rewards` address specified during construction time, a malicious path can lead to multiple pairs being exchanged artificially increasing volume and diminishing the final output sent to the `rewards` address.
Open the reportLowMisleading Error Message1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The error message alludes that ETH transfers are completely forbidden to the contract whereas transfers from contracts are allowed.
Open the reportLowPotential Code Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked line performs an on-chain conversion from the `address` low-level representation to its human-readable hexadecimal representation.
Open the reportLowProhibition of Ether Transfers1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The contract does not permit Ethereum transfers from contracts in contrast to `GovernanceFeeReceiver` .
Open the reportLowRedundant `isDefault` Invocation1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The `if` conditional that precedes those two statements already evaluates whether the vote is the default one, meaning a literal can be passed here instead.
Open the reportLowRedundant Use of Dynamic Arrays1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The functions of the Mooniswap contract accept statically sized arrays of 2 members whereas the `withdraw` prefixed functions accept dynamically sized arrays whose size is ensured to be `2` within their respective code block.
Open the reportLowSafeMath Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked mathematical statement conducts a `SafeMath` operation whilst its safety is guaranteed by the preceding `if` clause.
Open the reportShow 8 more
LowSafeMath Redundancy1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked statement conducts a `SafeMath` subtraction operation on the _totalSupply variable based on the amount burned from the `_balances` mapping. As the contract level variables of the contract are `private` , they cannot be altered by derivative implementations and as such, the `_totalSupply` is kept in perfect sync with the amount of total balance held in the `_balances` mapping. As a result, if a `SafeMath` subtraction operation succeeds on the `_balances` mapping it is guaranteed to succeed in the `_totalSupply` variable as well, rendering its use redundant gaswise.
Open the reportLowUnfair Proportionate Calculation1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked code block is meant to collect an epoch's share by calculating the percentage of shares a user has proportionate to the total supply of shares of a given epoch and multiply the resulting percentage with the total inch balance of the epoch.
Open the reportLowUser-Defined Getters1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked variables contain user-defined getter functions that are equivalent to their name barring for an underscore ( `_` ) prefix / suffix.
Open the reportLowVariable Typos1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked code lines contain a mispelling of the `default` word as `defaul` , leading to mistyped variable names.
Open the reportLowWhitelist Evaluation1inch Mooniswap v2 · CertiK · 16 Dec 2020Fixed
The linked `for` loop ensures that the elements in the `path` are whitelisted, however the first element is assumed to be whitelisted whilst it is not guaranteed so in the `require` checks of the function.
Open the reportLowEmpty reason for non-Chi tokens on out-of-gas exc1inch Exchange · CertiK · 15 Nov 2020Fixed
Whenever an out-of-gas exception occurs and the user is not using a Chi token as a substitute for gas, the `reason` variable will be empty (0x).
Open the reportLowNon-optimal extra ETH comparison logic1inch Exchange · CertiK · 15 Nov 2020Fixed
The `isExtraEthAllowed` flag alludes to a "permittance" rather than an enforcement, which the `require` condition of the linked line does.
Open the reportLowRedundant function calls in `swap` implementation1inch Exchange · CertiK · 15 Nov 2020Fixed
The `swap` function in the `OneInchExchange` contract makes multiple calls to the isETH function from the `UniERC20` contract and the `isPartialFill` and `isDiscountChi` functions in the `OneInchFlags` library, which is inefficient compared to storing their results in intermediate local variables and referencing those instead.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts1
| Address | Chain | Source code |
|---|---|---|
| 0x111111111117dc0aa78b770fa6a738034120c302 | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="1inch"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us