1inch - Aqua

Reward Calculation for All Reports

As Aqua is not yet deployed on mainnet with actual user funds, all severity levels have a base reward amount. At its discretion, 1inch may decide to provide a reward up to the maximum of each respective severity level. However, any amount higher than the base reward amount is not guaranteed and 1inch retains full rights in determining whether or not a report justifies a reward greater than the base reward amount. By default, only the base reward amount is provided and is what security researchers should expect.

Once Aqua is deployed to mainnet with live user funds, this section will be reviewed and updated to reflect production reward amounts. Reports submitted prior to mainnet deployment will be evaluated against the rules in effect at the time of submission. 1inch reserves the right to update reward amounts for new submissions after mainnet deployment.

Other Limitations and Requirements

https://github.com/1inch/sdks asset are out-of-scope.

Within the https://github.com/1inch/swap-vm asset, the file src/strategies/AquaAMM.sol is explicitly out of scope. Vulnerabilities or improvements affecting this file are not eligible for rewards.

Research License

Participants are granted a limited, non-exclusive, non-transferable license to compile, deploy, and test the Aqua codebase listed in the Assets in Scope table solely for the purpose of identifying vulnerabilities under this bug bounty program. This license:

• Is limited to local development environments, local forks, and testnets — production deployments and live mainnet usage are prohibited
• Does not permit redistribution, sublicensing, or commercial use of the code
• Does not transfer any intellectual property rights
• Provides safe harbor against claims under applicable computer fraud and copyright statutes (including but not limited to ARSL, EULA, DMCA, and CFAA) for actions taken in good faith and in compliance with the rules of this program
• Auto-terminates upon any breach of program rules, after which the safe harbor no longer applies and 1inch reserves all rights

This license applies only to the assets explicitly listed in scope and does not extend to any other 1inch property or third-party dependencies.

Publishing or distributing modified versions of Aqua source code, binaries, or compiled artifacts in any form is prohibited, both during and after the embargoed period. After coordinated disclosure, only minimal technical details necessary to describe the vulnerability or fix may be shared, and only with prior written approval from 1inch consistent with the Responsible Publication policy above.

Reward Payment Terms

Payouts are handled by the 1inch team directly and are denominated in USD. However, payments are done in USDC on Ethereum.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.

Reports and payout details may be checked against OFAC, EU, and UK sanctions lists prior to payment. Payment may be withheld, delayed, or refused entirely if prohibited by applicable law, sanctions regimes, or 1inch's compliance obligations. Researchers are responsible for ensuring their participation does not violate the laws of their jurisdiction.