Incident,
Source: De.Fi incident database.
- Audits before it
- 36.
- Audits since
- 6, the latest dated 2 Jul 2026.
As of 30 Oct 2026, 1inch Network has 42 audit reports by 13 security firms on Trustblock; the latest is by Hexens, dated 2 Jul 2026. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain and 1 incident (latest 6 Mar 2025).
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fusion | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| 1inch Sol security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Cross Chain Swaps Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Settlement Refactor Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order and Aggregation Protocols Diff A | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Protocol Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Aggregation Protocol Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Settlement Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Fusion V2 audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Cross Chain Swaps audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Settlement Phase II audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Settlement audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fusion v1 | Security firm: OXORIO | Date: | Scope: Repository at commit f975e2e | No open critical findings | Open · audits.oxor.io |
| 1inch – Limit Order | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch – Delegation | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch – ERC20 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch Aggregation Router V5 audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| 1inch Smart Contract Review (2nd iteration) | Security firm: Zokyo | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| 1inch Exchange AggregationRouter V5 | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 5 |
| High | 3 | 19 | 22 |
| Medium | 17 | 29 | 43 |
| Low | 50 | 136 | 148 |
The report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportIn the contract `ERC1155Proxy`, the role `immutableOwner` has the authority over the following function: - `func_301JL5R()`, which transfers tokens in an ERC1155 contract. Any compromise to the `immutableOwner` account may allow the hacker to take advantage of this and gain unauthorized access to token transfers.
In the contract `ERC721Proxy`, the role `immutableOwner` has the authority over the following function: - `func_602HzuS()`, which transfers NFT tokens in an ERC721 contract. Any compromise to the `immutableOwner` account may allow the hacker to take advantage of this and gain unauthorized access to token transfers.
In the contract `ERC721ProxySafe`, the role `immutableOwner` has the authority over the following function: - `func_602HzuS()`, which transfers NFT tokens in an ERC721 contract. Any compromise to the `immutableOwner` account may allow the hacker to take advantage of this and gain unauthorized access to token transfers.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
Open the reportThe report gives no description here.
Open the reportIn the `Create` context of the fusion-swap program, makers are required to specify protocol fee and integrator fee parameters as well as their corresponding associated token accounts (protocol_dst_ata and integrator_dst_ata). However, the current implementation does not enforce these parameters strictly. This means that a maker can potentially create an order without setting protocol or integrator fees or by misconfiguring the protocol_dst_ata. Consequently, the maker might avoid fee deductions and receive a higher net amount than intended by the protocol fee design. Note that even if the UI enforces fee parameters, malicious makers could bypass these checks by directly interacting with the program. While this issue might be less impactful because takers (or resolvers) must be whitelisted by the protocol and are incentivized to fill only orders with correct fee configurations, it still poses a risk. In practice, resolvers may refuse to fill orders that do not have fees applied to the correct token accounts, but the absence of on-chain enforcement or fixed values allows makers to manipulate these parameters.
Open the reportIn the `get_fee_amounts()` function of the fusion-swap program, surplus fees are conditionally applied based on the comparison between the calculated destination amount (after applying the Dutch auction adjustments and subtracting the protocol and integrator fees) and the user-supplied `estimated_dst_amount`. Specifically, the surplus fee is added only if the adjusted destination amount exceeds the `estimated_dst_amount`. This design allows a maker to avoid the impact of surplus fees by setting the `estimated_dst_amount` to an excessively high value relative to `min_dst_amount`. As a result, the condition to trigger the surplus fee is never met, and the protocol fee component intended to capture surplus (positive slippage) is effectively bypassed.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportA reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.
A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.
The report gives no description here.
The report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe protocol does not enforce the `authority` constraint on the `taker_src_ata` account. This allows the taker to provide any account as long as the `mint` constraint is correct, which can lead to fund loss if an incorrect address is provided.
Open the reportThe protocol allows the maker to set a `min_dst_amount` during order creation. By definition, this amount represents the minimum destination tokens the maker is willing to receive in exchange for source tokens. However, the protocol currently uses this amount to calculate exchange rates via the `get_dst_amount()` function and then deducts fees from the calculated amount using the `get_fee_amounts()` function. However, under certain conditions—particularly when the calculated fees (protocol, integrator, and surplus) exceed the bump provided by the Dutch auction—the resulting destination amount for the maker may fall below the intended `min_dst_amount`. This behavior effectively breaks the slippage protection mechanism. Makers expect `min_dst_amount` to represent the minimum amount of destination tokens they will receive, but due to the fee calculations, they may receive less than this minimum.
Open the reportThe protocol documentation specifies that the auction operates on a Dutch auction model, where the price is expected to decline over time. However, in the `calculate_rate_bump()` function in `fusion-swap/src/dutch_auction.rs`, there is no check to ensure that the rate bumps specified by the user in `points_and_time_deltas` are in a strictly declining order. This omission allows a user to supply rate bump values that could be non-monotonic (i.e., a subsequent bump could be higher than a previous one), which contradicts the intended Dutch auction behavior and the protocol documentation.
Open the reportThe fusion-swap program currently allows makers to supply fee parameters via the `ReducedFeeConfig` and rate bump values in the Dutch auction data without performing explicit bound checks. Unlike the surplus fee—which is validated to be less than `BASE_1E2`—there is no on-chain validation to ensure that: - The protocol fee and integrator fee values (or their sum) are within a reasonable range (e.g., less than or equal to `BASE_1E5`). Without this check, makers could specify arbitrarily high fees, potentially leading to unintended pricing behavior and potential underflow when substracting the fees from the `dst_amount`. - The rate bumps provided in the Dutch auction parameters are within an acceptable range relative to `BASE_1E5`. This extra validation would help prevent overflow in the `calculate_rate_bump()` function and ensure that the auction price adjustment behaves as intended.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
Open the reportThe report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
The report gives no description here.
Attached through a shared contract address. Our incident data ends in Oct 2026.
Source: De.Fi incident database.
| Address | Chain | Source code |
|---|---|---|
| 0x1111…c3020x111111111117dc0aa78b770fa6a738034120c302 | Chain: Ethereum | Source code: Verified source |
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="1inch"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us