1inch
Leading DEX aggregator finding optimal swap routes across multiple protocols for the best token exchange rates.
https://1inch.ioMax Reward
$50,000
Total Paid
$900,000
Resolved
56
Avg Response
3 days
In-Scope Assets
app.1inch.io
Swap interface and limit orders
Aggregation Protocol
Smart contract routing and execution
1inch API
Swap, quote, and token APIs
1inch Wallet
Mobile wallet application
Out of Scope
- ✕ 1inch DAO governance
- ✕ Third-party integrations
- ✕ Documentation site
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (1)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| INCH-001 | Swap routing manipulation extracting excess user tokens | Critical | Open | $15,000–$50,000 | 0 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.