1inch - Smart Contracts

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Impacts in Scope table.

Reward Calculation for Critical Level Reports

For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 500000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 30000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.

Repeatable Attack Limitations

• If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward.

• If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 1 hour the attack needs for subsequent attacks from the first attack, rounded down.

Reward Calculation for High Level Reports

High vulnerabilities concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of 10000 to 30000 capped at the maximum high reward. This is calculated at 100% of the funds affected.

In the event of temporary freezing, the reward doubles from the full frozen value for every additional 24h that the funds are temporarily frozen, up until a max cap of the High severity reward.

Additional Terms

In order to qualify for a Critical reward, the demonstrated impact must not only be possible in the in-scope code listed in the Assets in Scope table, but also live on a mainnet deployment. Otherwise, the severity level will be attributed as High and the reward will be determined within the full High severity range (USD 10,000 – USD 30,000) based on the demonstrated impact at the full discretion of the 1inch team. The 1inch team reserves the right to further downgrade and reduce the reward amount for any impact resulting from vulnerabilities or attack vectors involving code that is not deployed on mainnet.

Impacts resulting from vulnerabilities in imported contracts are considered as out of scope.

Any vulnerability discovered must be reported no later than 24 hours after the initial discovery. Reports submitted after this window may be considered at 1inch's discretion but are not guaranteed eligibility for a reward.

In cases where the same vulnerability is reported through multiple platforms, priority will be determined by the earlier submission timestamp, regardless of the platform used.

Medium impacts have a base reward of USD 2 000. At the sole discretion of the 1inch team, it may decide to reward above USD 2 000, though no higher than USD 10 000. Low impacts have a base reward of USD 100. At the sole discretion of the 1inch team, it may decide to reward above USD 100, though no higher than USD 2 000.

Reward Payment Terms

Payouts are handled by the 1inch team directly and are denominated in USD. However, payments are done in USDC on Ethereum.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.

Reports and payout details may be checked against OFAC, EU, and UK sanctions lists prior to payment. Payment may be withheld, delayed, or refused entirely if prohibited by applicable law, sanctions regimes, or 1inch's compliance obligations. Researchers are responsible for ensuring their participation does not violate the laws of their jurisdiction.