1inch - Wallet

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Impacts in Scope table.

Reward Calculation for Critical Level Reports

For critical web/apps bugs, reports will be rewarded with 100000, only if the impact leads to:

• A loss of funds involving an attack that does not require any user action
• Private key or private key generation leakage leading to unauthorized access to user funds

All other impacts for assets with those designations that would be classified as Critical would be rewarded a flat amount of 30000.

Reward Calculation for Other Levels

High, Medium, and Low reports are rewarded at a flat rate of USD 10 000, USD 2 000, and USD 100, respectively. At the discretion of 1inch, it may decide to increase the reward paid out to security researchers for exceptional cases. However, it makes no commitment to rewarding above these amounts. The maximum reward listed on the table provided is only as guidance for the maximum that could ever be expected in even the most exceptional cases within those severity levels.

Other Restrictions and Limitations

The listed app store URLs reference the official 1inch Wallet applications. Testing should be performed against the latest production version of the wallet downloaded from the listed app stores. Beta, staging, or modified builds (including but not limited to APKs from third-party sources, side-loaded variants, or self-built versions) are not considered as production assets and fall under the non-production severity cap above.

Additional Terms

Any vulnerability discovered must be reported no later than 24 hours after the initial discovery. Reports submitted after this window may be considered at 1inch's discretion but are not guaranteed eligibility for a reward.

In cases where the same vulnerability is reported through multiple platforms, priority will be determined by the earlier submission timestamp, regardless of the platform used.

Reward Payment Terms

Payouts are handled by the 1inch team directly and are denominated in USD. However, payments are done in USDC on Ethereum.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.

Reports and payout details may be checked against OFAC, EU, and UK sanctions lists prior to payment. Payment may be withheld, delayed, or refused entirely if prohibited by applicable law, sanctions regimes, or 1inch's compliance obligations. Researchers are responsible for ensuring their participation does not violate the laws of their jurisdiction.