1inch - Infrastructure

Rewards by Threat Level

Reward Calculation for Critical Level Reports

For critical infrastructure bugs, reports will be rewarded with the maximum critical reward (USD 20,000) only if the impact leads to:

• Full compromise of production infrastructure (e.g., RCE on production servers, full IAM takeover)
• Disclosure of credentials or secrets that grant attacker-level access to production systems and could lead to direct loss of user funds or critical data

All other impacts that would be classified as Critical would be rewarded a flat amount of 5000. The rest of the severity levels are paid out according to the Impact in Scope table.

Reward Calculation for High and Medium Level Reports

For High, Medium, and Low level reports, 1inch retains the full right to determine the reward amounts within the range provided due to the lack of objective scaling systems to determine the reward amount. It does not commit to rewarding anything above the base amounts. Rewards going above the base amounts are entirely within the discretion of the 1inch team.

Other Restrictions and Limitations

Vulnerabilities reported for blog.1inch.com, business.1inch.com (root subdomain), and assets falling under "Rest related to 1inch" are capped at Medium severity. The maximum reward for these assets is USD 2,500.

For the listed wildcard assets, only direct (one-level) subdomains of 1inch.com and 1inch.network are in scope. These cover any 1inch-controlled subdomain, asset, or service that is not explicitly listed in the Assets in Scope table but is verifiably operated by 1inch (e.g., reachable via DNS records under *.1inch.com or *.1inch.network and serving production traffic). Vulnerabilities in such assets are capped at Medium severity. 1inch reserves sole discretion to determine whether an asset qualifies.

Vulnerabilities affecting social media accounts (Telegram, Reddit, X/Twitter, Discord, and similar) are eligible only for impacts that result from a technical vulnerability directly attributable to 1inch's configuration or infrastructure, not from compromise of individual employee credentials, third-party platform vulnerabilities, or platform-wide issues affecting all users of that platform. Such reports are capped at High severity.

Reports combining multiple lower-severity findings into a meaningful impact will be evaluated based on the final combined demonstrated impact, not on individual components. Each component must still be a valid technical finding, and the chain must be reproducible end-to-end with a working PoC.

Gaps in logging, monitoring, or alerting are not eligible as standalone reports. They will only be considered as part of a report demonstrating exploitation of another in-scope vulnerability, where the absence of detection materially extends the attacker's window of opportunity. This must be demonstrated within the PoC, not asserted theoretically.

Additional Terms

For social media accounts, only impacts that affect those specific accounts/channels but do not affect all or others on those respective platforms on a platform-wide basis are considered as in-scope. All others are considered out-of-scope.

Any vulnerability discovered must be reported no later than 24 hours after the initial discovery. Reports submitted after this window may be considered at 1inch's discretion but are not guaranteed eligibility for a reward.

In cases where the same vulnerability is reported through multiple platforms, priority will be determined by the earlier submission timestamp, regardless of the platform used.

Reward Payment Terms

Payouts are handled by the 1inch team directly and are denominated in USD. However, payments are done in USDC on Ethereum.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.

Reports and payout details may be checked against OFAC, EU, and UK sanctions lists prior to payment. Payment may be withheld, delayed, or refused entirely if prohibited by applicable law, sanctions regimes, or 1inch's compliance obligations. Researchers are responsible for ensuring their participation does not violate the laws of their jurisdiction.