Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 36.
- Audits since
- 6, the latest dated 2 Jul 2026.
1inch Network security record
As of 30 Oct 2026, 1inch Network has 42 audit reports by 13 security firms on Trustblock; the latest is by Hexens, dated 2 Jul 2026. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain and 1 incident (latest 6 Mar 2025).
Critical findings
2 open critical findings
Reported in “1inch Liquidity Protocol” by Consensys, Dec 2020. Not marked fixed in that report. See the findings
Incident
Incident 6 Mar 2025
Source: De.Fi incident database. 6 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits42
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| 1inch Crosschain security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fusion | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| 1inch Sol security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Cross Chain Swaps Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Settlement Refactor Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order and Aggregation Protocols Diff A | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Protocol Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Aggregation Protocol Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Limit Order Settlement Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| 1inch Fusion V2 audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Cross Chain Swaps audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Settlement Phase II audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Limit Order Settlement audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| 1inch Fusion v1 | Security firm: OXORIO | Date: | Scope: Repository at commit f975e2e | No open critical findings | Open · audits.oxor.io |
| 1inch – Limit Order | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch – Delegation | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch – ERC20 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| 1inch Aggregation Router V5 audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| 1inch Smart Contract Review (2nd iteration) | Security firm: Zokyo | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| 1inch Exchange AggregationRouter V5 | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
Findings474
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 5 |
| High | 3 | 19 | 22 |
| Medium | 17 | 29 | 43 |
| Low | 50 | 136 | 148 |
CriticalGriefing Attack via Missing timelocks and mint in Escrow PDA Seeds on Destination Chain1inch Crosschain security review · Hexens · 5 Aug 2025Fixed
The report gives no description here.
Open the reportCriticalOrder fulfillment can be front-ran to steal from taker using reinitialization1inch Sol security review · Hexens · 21 Feb 2025Fixed
The report gives no description here.
Open the reportCriticalUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportCriticalUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportCriticalUntitled findingFixed
The report gives no description here.
HighOrder Forgery via Reused PDA Seeds Could Lead to Fund Theft1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportHighThe create_escrow function sets an incorrect token amount in the escrow data1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportHighThe later “calldataload” opcode is redundant, as the action point bump was already read by the former “calldataload”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportHighSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportHighUnclear behavior in VotingPowerCalculator.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
HighThere is no value for feeReceiver in the constructor in St1Inch1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportHighPod.updateBalances() Cannot Transfer ERC20Pods1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportHighPossible Frontrunning on Registration1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Fixed
The report gives no description here.
Open the reportHighUntitled finding1inch Smart Contract Review (2nd iteration) · Zokyo · 5 Aug 2022Fixed
The report gives no description here.
Open the reportShow 10 more
High[H01] Inconsistent data passed into _makeCallFixed
The report gives no description here.
High[H02] Partially-filled private orders can be filled by anyoneFixed
The report gives no description here.
High[H03] Malicious maker could take advantage of partial fills to steal taker’s assetsFixed
The report gives no description here.
HighGas GriefingFixed
The report gives no description here.
HighGenericRouter.sol: function _swap(), line 165.Fixed
The report gives no description here.
HighThe `_callGetter()` Function Can Return IncorrectFixed
The `_callGetter()` function on line 330 is meant to return a `makerAmount` when given `takerAmount` data and similarly return a `takerAmount` when given `makerAmount` data. However, if `getter.length == 0`, it actually returns an amount that is of the same type as the input. ```solidity=330 function _callGetter(bytes memory getter, uint256 orderAmount, uint256 amount) private view returns(uint256) { if (getter.length == 0) { // On empty getter calldata only exact amount is allowed require(amount == orderAmount, "LOP: wrong amount"); return orderAmount; ```
HighUntitled findingFixed
The report gives no description here.
MediumAmount-in fee wrapper can override SplineSwap exact-in partial fill1inch security review · Hexens · 2 Jul 2026Fixed
The report gives no description here.
Open the reportMediumAn attacker can pre-create the ATA before the escrow or order is initialized to cause a DoS in escrow creation1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportMediumConsider Paying Fees in the Native Sol Token when the `native_dst_asset` Flag Is Set1inch Fusion · Quantstamp · 24 Mar 2025Fixed
The protocol allows the maker to set the `native_dst_asset` flag during order creation to indicate that they want to receive the native SOL token in exchange for their source tokens. The `fill()` function considers this flag when paying out to the maker; however, it does not do the same for the protocol fee. This means the protocol fee will always be in the destination token, regardless of `native_dst_asset`. This can create issues since, when a maker sets this flag, they might not provide proper values for the destination token account.
Open the reportShow 10 more
MediumForged Event Emission1inch Limit Order Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportMediumFee Regulation Might Not Work as Expected on Non-Mainnet Chains1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportMediumNo Masking of Addresses in SafeERC20 Library1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect modifier used1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportMediumInteger overflow in TimelocksLib1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that ”addressPtr” calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that ”addressPtr” calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that calldata offset calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no check to ensure that calldata offset calculated here points inside ”interaction”.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no length check for “details”, so here data before “details” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumThere is no length check for “details”, so here data before “details” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no length check for “details”, so here data before “details” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumThere is no length check for “interaction”, so here data before “interaction” could be loaded from the calldata.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumUnderflow is possible here.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportMediumOverflow/Underflow in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumOverflow/Underflow in VotingPowerCalculator.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumProcedural in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumUnclear behavior in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumUnclear behavior in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportMediumfeeReceiver can be zero address in St1Inch1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumThere is no validation of promoted addresses in WhitelistRegistry1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportMediumThere is no validation that Pod has a valid token in ERC20Pods.1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportMediumAllowances Not Completely Disabled1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportMediumSt1inch Can Be Locked Indefinitely1inch – Limit Order · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMediumUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportMedium[M01] Cannot unpause exchangeFixed
The report gives no description here.
Show 10 more
Medium[M01] Lack of output safeguards could lead to loss of fundsFixed
The report gives no description here.
Medium[M02] Cannot decrease allowance to non-zero valueFixed
The report gives no description here.
Medium[M02] ERC721 orders can be manipulatedFixed
The report gives no description here.
Medium[M03] Incorrect safeApprove usageFixed
The report gives no description here.
Medium[M03] Undocumented decimal assumptionsFixed
The report gives no description here.
MediumIncorrect Stake Notification ImplementationFixed
The `notifyFor` function is meant to be used to allow any address to force a status update of another `address` arbitrarily to ensure the stakes states are kept in sync. However, the second argument passed to the `_notifyFor` function is the balance of the `msg.sender` instead of the account to-be-notified, causing an incorrect balance to be reported for it and potentially for as many accounts as a particular `msg.sender` wants.
MediumIncorrect Variable UsedFixed
In the function `fillOrderTo()`, the function makes a call to `order.makerAsset`. ```solidity=273 _makeCall( order.makerAsset, abi.encodePacked( IERC20.transferFrom.selector, uint256(uint160(order.maker)), uint256(uint160(target)), makingAmount, order.makerAsset ) ); ``` However, if we understood the `Order` struct correctly, the `order.makerAsset` at the end of the `abi.encodePacked` should instead be `order.makerAssetData`.
MediumInexistent Input Sanitization of Mooniswap AddresFixed
The linked code blocks link to function implementations within `ReferralFeeReceiver` that do not conduct any sanitization on the input `mooniswap` variable and invoke functions on it.
MediumUntitled findingFixed
The report gives no description here.
MediumUntitled findingFixed
The report gives no description here.
Show 10 more
LowOne-Sided SplineSwap Orders Are Non-Functional1inch security review · Hexens · 2 Jul 2026Fixed
The report gives no description here.
Open the reportLowTaker Can Extract a Small Amount of Base Tokens with Zero Quote Input1inch security review · Hexens · 2 Jul 2026Fixed
The report gives no description here.
Open the reportLowBidirectional PeggedSwap normalization mismatch in asymmetric configurations1inch security review · Hexens · 9 Mar 2026Fixed
The report gives no description here.
Open the reportLowMissing validation of the mint account in the PublicCancelEscrow context1inch Crosschain security review · Hexens · 11 Jul 2025Fixed
The report gives no description here.
Open the reportLowIncomplete DocstringsCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowLack of Sensitive Event EmissionCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowMissing DocstringsCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowpublicWithdraw Can Happen During CancellationCross Chain Swaps Audit · OpenZeppelin · 14 Nov 2024Fixed
The report gives no description here.
Open the reportLowExternal Calls Have a Hard-Coded Gas Limit1inch Limit Order Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportLowIncomplete Interface1inch Limit Order Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowAssembly Block Diverges from Solidity's Memory Model1inch Aggregation Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportLowRestricted External Calls Can Be Made on Behalf of AggregationRouter1inch Aggregation Protocol Diff Audit · OpenZeppelin · 23 May 2024Fixed
The report gives no description here.
Open the reportLowDiscrepancy Between Proposal and Implementation1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportLowLack of Input Parameter Validation1inch Limit Order Settlement Audit · OpenZeppelin · 20 May 2024Fixed
The report gives no description here.
Open the reportLowTokens can be sweeped from FeeTaker1inch Fusion V2 audit · Decurity · 2 Apr 2024Fixed
The report gives no description here.
Open the reportLowLack of event emitting1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportLowMaker can withdraw from EscrowDst1inch Cross Chain Swaps audit · Decurity · 15 Mar 2024Fixed
The report gives no description here.
Open the reportLow_CURFE() ALLOWS ANY FUNCTION SELECTOR FOR AN EXTERNAL CALL1inch security review · Hexens · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowWETH CASE SHOULD BE HANDLED BY CLIPPEREXCHANGE.SWAP()1inch security review · Hexens · 6 Nov 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in FusionDetails.sol1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowThe condition “interaction.length < 20” condition is always true as otherwise slicing would fail.1inch Limit Order Settlement Phase II audit · ABDK Consulting · 19 Jun 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in FeeBankCharger.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in Pod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in Pod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad datatype in VotingPowerCalculator.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowBad naming in IDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in IFeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowBad naming in IFeeBankCharger.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowDocumentation in BasicDelegationPodWith-1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowDocumentation in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowReadability in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowReadability in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowReadability in Settlement.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in BasicDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in FeeBank.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in IERC20Pods.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in RewardableDelegationPod.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuboptimal in St1inch.sol1inch Limit Order Settlement audit · ABDK Consulting · 28 Feb 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowThe _DEFAULT_INITIAL_RATE_BUMP and _DEFAULT_DURATION constants are not used in Settlement1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportLowThere is no validation of constructor parameters in FeeBank1inch Fusion v1 · OXORIO · 28 Dec 2022Fixed
The report gives no description here.
Open the reportLowBroken C-E-I Pattern1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowERC20Pods podsLimit Sanitization1inch – ERC20 · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowInconsistency and Zero Address Check on register()1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowMissing Events1inch – ERC20 · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowNo Event upon Registering Delegatee1inch – Delegation · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowOperations Order on Pod Removal1inch – ERC20 · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowResolver Can Set Arbitrary Callback1inch – Limit Order · ChainSecurity · 19 Dec 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLowUntitled finding1inch Aggregation Router V5 audit · ABDK Consulting · 16 Sep 2022Fixed
The report gives no description here.
Open the reportLow[L01] Constants not declared explicitlyFixed
The report gives no description here.
Low[L01] Deposit can revert on underflowFixed
The report gives no description here.
Show 10 more
Low[L04] Constants not declared or clearly namedFixed
The report gives no description here.
Low[L04] Erroneous or misleading test suiteFixed
The report gives no description here.
Low[L06] Storage changes during event emissionFixed
The report gives no description here.
Low[L07] Inconsistent decoding methodologies could cause outcome discrepanciesFixed
The report gives no description here.
Low[L08] Lack of input validationFixed
The report gives no description here.
Low[L08] Unsafe explicit casting of integersFixed
The report gives no description here.
Low[L13] Contradictory order handling when lacking parametersFixed
The report gives no description here.
Low[L14] Using deprecated Chainlink callsFixed
The report gives no description here.
Low`require` ConsistencyFixed
The project imposes `require` checks on multiple functions, like L255 of `_doTransfers`, to ensure that zero value swaps etc. are prohibited. The `withdrawFor` function fails to impose such a check as it merely ensures that the `value` is greater-than-or-equal to `minReturns[i]` which itself could be `0`.
Low`SafeMath` RedundancyFixed
The linked mathematical operations utilize their `SafeMath` counterpart implementation whereas it is completely reudndant for the operations of L31 and L34 as well as potentially redundant for the operation of L30.
Show 10 more
Low`SafeMath` RedundancyFixed
The linked statement conducts a `SafeMath` subtraction operation on the `_totalSupply` variable based on the amount burned from the `_balances` mapping. As the contract level variables of the contract are `private`, they cannot be altered by derivative implementations and as such, the `_totalSupply` is kept in perfect sync with the amount of total balance held in the `_balances` mapping. As a result, if a `SafeMath` subtraction operation succeeds on the _balances mapping it is guaranteed to succeed in the `_totalSupply` variable as well, rendering its use redundant gaswise.
Low`SafeMath` RedundancyFixed
The linked statements all conduct `SafeMath` operations whilst the safety of their operations is guaranteed by the system either via `if-else` clauses or constant variable utilizations
Low`SafeMath` RedundancyFixed
The linked statements both contain redundant operations as they are nested within an `if-else` block that guarantees their validity
Low`SafeMath` RedundancyFixed
The linked statements conduct `SafeMath` operations when their safety may be guaranteed by the system for the first and last linked statements and is fully guaranteed for the middle statement.
LowCode qualityFixed
In OrderMixin contract, result.length is checked to be greater than 0 in: - simulateCalls() function at line 115. - _makeCall() function at line 285. We recommend verifying that result.length is not less than 32 before decoding it to bool variable.
LowCode qualityFixed
The report gives no description here.
LowCode qualityFixed
The report gives no description here.
LowCode qualityFixed
The report gives no description here.
LowCommented CodeFixed
The report gives no description here.
LowDisproportionate Initial MintingFixed
The initial minting process of a Mooniswap appears to be disproportionate in the sense that it does not rely on the initial deposit, meaning that a user can simply deposit only a single unit and acquire a mint equal to `_BASE_SUPPLY.mul(99)` as only a `Math.max` operation is used on L145.
Show 10 more
LowDocumentation ConsistencyFixed
The linked documentation block is meant to explain the calculations carried out in `_getReturn` , however the variable naming conventions of the function block do not conform to what is laid out in the documentation and the documentation itself appears inconsistent with the statements of the function.
LowEmpty reason for non-Chi tokens on out-of-gas excFixed
Whenever an out-of-gas exception occurs and the user is not using a Chi token as a substitute for gas, the `reason` variable will be empty (0x).
LowEvent IndexingFixed
The `Swapped` event is indexing the source token, however, the destination token remains unindexed
LowfarmingCheckpoint() Has No FunctionalityFixed
The report gives no description here.
LowFarms Rely on Token to CheckpointFixed
The report gives no description here.
LowFunctionality of `decodeBool()`Fixed
The `decodeBool()` function does not check if the bytes input is 0 or 1, but rather if it is non-zero. Any non-zero data will be decoded into `true`.
LowGas InefficienciesFixed
The report gives no description here.
LowGas Inefficiency of ValidationFixed
In the function `fillOrderRFQTo()`, the function checks whether the order is valid near the end of the function call. ```solidity=139 require(order.allowedSender == address(0) || order.allowedSender == msg.sender, "LOP: private order"); bytes32 orderHash = _hashTypedDataV4(keccak256(abi.encode(LIMIT_ORDER_RFQ_TYPEHASH, order))); require(SignatureChecker.isValidSignatureNow(maker, orderHash, signature), "LOP: bad signature"); ``` It might be more optimal to locate these checks at the start of the function call so extraneous calculations are not performed.
LowIncorrect `to` ConditionalFixed
The linked `_beforeTokenTransfer` hook incorrectly sanitizes burn operations by evaluating whether the `from` instead of the to variable is different than the zero address for the ternary operator used on the balanceTo assignment.
LowIncorrect Implementation / Naming ConventionFixed
The naming convention utilizing `tax` alludes to a tax being imposed on the balances, however L323 assigns the addition instead of the subtraction of the tax from the `srcBalance`.
Show 10 more
LowIncorrect len Boundry CheckFixed
The boundary check of the `len` variable is meant to ensure that the `len` variable can fit within a single 8-bit slot by ensuring its within its valid range. However, the upper bound specified is incorrect.
LowIncorrect Transfer EvaluationFixed
The linked code invokes `uniTransferFrom` for an amount equal to `maxAmounts[i]` and consequently assigns that value to `receivedAmounts[i]` even if a token imposes fees on the transaction.
LowIneffective period CheckFixed
The report gives no description here.
LowInexistent Access ControlFixed
The linked functions are meant to conduct sensitive operations on the contract and utilize its full balance to conduct a swap. Even though the target of a given `swap` operation will always be the `rewards` address specified during construction time, a malicious path can lead to multiple pairs being exchanged artificially increasing volume and diminishing the final output sent to the `rewards` address.
LowIntroduction of Batched OperationsFixed
The report gives no description here.
LowMisleading Error MessageFixed
The error message alludes that ETH transfers are completely forbidden to the contract whereas transfers from contracts are allowed.
LowMissing Emit EventsFixed
The following function affects the status of sensitive variables and should be able to emit events as notifications: - `OrderRFQMixin.cancelOrderRFQ()` to cancel an RFQ order.
LowMisspelled Error MessageFixed
One of the error messages in the function `fillOrderTo()` is misspelled. ```solidity=202 require(remainingMakerAmount != 1, "LOP: remaining amoint is 0"); ``` The error message should instead be "LOP: remaining amount is 0".
LowNon-optimal extra ETH comparison logicFixed
The `isExtraEthAllowed` flag alludes to a "permittance" rather than an enforcement, which the `require` condition of the linked line does.
LowPotential Code RedundancyFixed
The linked line performs an on-chain conversion from the `address` low-level representation to its human-readable hexadecimal representation.
Show 10 more
LowProhibition of Ether TransfersFixed
The contract does not permit Ethereum transfers from contracts in contrast to `GovernanceFeeReceiver` .
LowRedundant `isDefault` InvocationFixed
The `if` conditional that precedes those two statements already evaluates whether the vote is the default one, meaning a literal can be passed here instead.
LowRedundant function calls in `swap` implementationFixed
The `swap` function in the `OneInchExchange` contract makes multiple calls to the isETH function from the `UniERC20` contract and the `isPartialFill` and `isDiscountChi` functions in the `OneInchFlags` library, which is inefficient compared to storing their results in intermediate local variables and referencing those instead.
LowRedundant Use of Dynamic ArraysFixed
The functions of the Mooniswap contract accept statically sized arrays of 2 members whereas the `withdraw` prefixed functions accept dynamically sized arrays whose size is ensured to be `2` within their respective code block.
LowSafeMath RedundancyFixed
The linked mathematical statement conducts a `SafeMath` operation whilst its safety is guaranteed by the preceding `if` clause.
LowSafeMath RedundancyFixed
The linked statement conducts a `SafeMath` subtraction operation on the _totalSupply variable based on the amount burned from the `_balances` mapping. As the contract level variables of the contract are `private` , they cannot be altered by derivative implementations and as such, the `_totalSupply` is kept in perfect sync with the amount of total balance held in the `_balances` mapping. As a result, if a `SafeMath` subtraction operation succeeds on the `_balances` mapping it is guaranteed to succeed in the `_totalSupply` variable as well, rendering its use redundant gaswise.
LowUnfair Proportionate CalculationFixed
The linked code block is meant to collect an epoch's share by calculating the percentage of shares a user has proportionate to the total supply of shares of a given epoch and multiply the resulting percentage with the total inch balance of the epoch.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
Show 10 more
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
Show 10 more
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
Show 8 more
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUntitled findingFixed
The report gives no description here.
LowUsage as a LibraryFixed
The report gives no description here.
LowUser-Defined GettersFixed
The linked variables contain user-defined getter functions that are equivalent to their name barring for an underscore ( `_` ) prefix / suffix.
LowUsers May Lose Money on Partial Order FillsFixed
The `getMakerAmount()` function gives the floor of `swapTakerAmount * orderMakerAmount / orderTakerAmount`, while `getTakerAmount()` gives the ceiling of `swapMakerAmount * orderTakerAmount / orderMakerAmount`. For users that partially fill orders with small amounts, they may potentially lose money. For example, suppose `orderMakerAmount = 10` and `orderTakerAmount = 3`, so the ratio between maker tokens and taker tokens is 10:3. If a user planned to exchange 1 taker token, then they would receive `getMakerAmount(10,3,1) = 3` maker tokens, due to a floor rounding, resulting in a loss of 0.33 maker tokens. If a user instead wished to obtain 1 maker token, then they would have to pay `getTakerAmount(10,3,1) = 1` taker token, due to the ceiling rounding, resulting in an overpay of 0.7 taker tokens.
LowVariable TyposFixed
The linked code lines contain a mispelling of the `default` word as `defaul` , leading to mistyped variable names.
LowWhitelist EvaluationFixed
The linked `for` loop ensures that the elements in the `path` are whitelisted, however the first element is assumed to be whitelisted whilst it is not guaranteed so in the `require` checks of the function.
Incidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts1
| Address | Chain | Source code |
|---|---|---|
| 0x111111111117dc0aa78b770fa6a738034120c302 | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="1inch"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us