Triaged by Immunefi
PoC Required
KYC required
Rewards
Rewards by Threat Level
Primacy of Impact vs Primacy of Rules
1inch - Business adheres to the Primacy of Rules, which means that the whole bug bounty program is run strictly under the terms and conditions stated within this page.
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Impacts in Scope table.
Reward Calculation for Critical Level Reports
For critical web/apps bugs, reports will be rewarded with 100000, only if the impact leads to:
- A loss of funds involving an attack that does not require any user action
- Private key or private key generation leakage leading to unauthorized access to user funds
All other impacts for assets with those designations that would be classified as Critical would be rewarded a flat amount of 30000.
Reward Calculation for Other Levels
High, Medium, and Low reports are rewarded at a flat rate of USD 10 000, USD 2 000, and USD 100, respectively. At the discretion of 1inch, it may decide to increase the reward paid out to security researchers for exceptional cases. However, it makes no commitment to rewarding above these base amounts.
Other Restrictions and Limitations
Only the listed subdomains and exact pages in the Assets in Scope table are considered as in-scope. All other subdomains and pages are out of scope for this bug bounty program.
Vulnerabilities reported for business.1inch.com and business.1inch.com/portal/documentation are capped at Medium severity. The maximum reward for these assets is USD 10000.
Vulnerabilities found in non-production environments (including but not limited to staging, development, and preview deployments) are capped at High severity. The maximum reward for non-production vulnerabilities is USD 30000.
Reward Payment Terms
Payouts are handled by the 1inch team directly and are denominated in USD. However, payments are done in USDC on Ethereum.
The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.
Reports and payout details may be checked against OFAC, EU, and UK sanctions lists prior to payment. Payment may be withheld, delayed, or refused entirely if prohibited by applicable law, sanctions regimes, or 1inch's compliance obligations. Researchers are responsible for ensuring their participation does not violate the laws of their jurisdiction.
Program Overview
The bug bounty program is focused on the “1inch Business”, a Web3 cloud SaaS (software as a service) platform offering multiple software services.
For more information about 1inch, please visit https://1inch.com/.
1inch provides rewards in USDC on Ethereum, denominated in USD. For more details about the payment process, please view the Rewards by Threat Level section further below.
1inch maintains six additional bug bounty programs on Immunefi. In addition to this, they are:
Audits
Completed audit reports for this project can be found at the links below.
Any unpatched or unresolved vulnerabilities disclosed in these reports are not eligible for rewards.
KYC required
The submission of KYC information is a requirement for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 3: Approval Required
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.