The 1inch dApp is the No. 1 DeFi aggregator, offering access to the deepest liquidity and the best token swap rates on various DEXes. Its unique features include partial fill and the ability to find the best swap paths across multiple liquidity sources.
Triaged by Immunefi
PoC Required
KYC required
Rewards
Rewards by Threat Level
All other impacts that are classified as Critical will be rewarded a flat amount of:
$15,000The rest of the severity levels are paid out according to the Impact in Scope table.
Primacy of Impact vs Primacy of Rules
1inch - Web adheres to the Primacy of Rules, which means that the whole bug bounty program is run strictly under the terms and conditions stated within this page.
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Impacts in Scope table.
Reward Calculation for Critical Level Reports
For critical web/apps bugs, reports will be rewarded with 50000, only if the impact leads to:
- A loss of funds involving an attack that does not require any user action
- Private key or private key generation leakage leading to unauthorized access to user funds causing a final impact of “Direct Theft of User Funds”
All other impacts for assets with those designations that would be classified as Critical would be rewarded a flat amount of 15000.
Reward Calculation for Other Levels
High, Medium, and Low reports are rewarded at a flat rate of USD 5 000, USD 1 000, and USD 100, respectively. At the discretion of 1inch, it may decide to increase the reward paid out to security researchers for exceptional cases. However, it makes no commitment to rewarding above these amounts.
Only the listed subdomains and exact pages in the Assets in Scope table are considered as in-scope. All other subdomains and pages are out of scope for this bug bounty program.
For the impact “Taking over broken or expired outgoing links”, this does not apply to broken links on blog.1inch.com when referencing an external link on a blog post. This also doesn’t apply to social media assets and posts, unless it only involves an internal link.
Vulnerabilities reported for blog.1inch.com are capped at Medium severity regardless of the impact demonstrated. The maximum reward for blog.1inch.com is USD 5000 at the discretion of the 1inch team with a base reward of USD 1000.
Additional Terms
Any vulnerability discovered must be reported no later than 24 hours after the initial discovery. Reports submitted after this window may be considered at 1inch's discretion but are not guaranteed eligibility for a reward.
In cases where the same vulnerability is reported through multiple platforms, priority will be determined by the earlier submission timestamp, regardless of the platform used.
Reports and payout details may be checked against OFAC, EU, and UK sanctions lists prior to payment. Payment may be withheld, delayed, or refused entirely if prohibited by applicable law, sanctions regimes, or 1inch's compliance obligations. Researchers are responsible for ensuring their participation does not violate the laws of their jurisdiction.
Program Overview
For more information about 1inch, please visit https://1inch.com/.
1inch provides rewards in USDC on Ethereum, denominated in USD. For more details about the payment process, please view the Rewards by Threat Level section further below.
1inch maintains six additional bug bounty programs on Immunefi. In addition to this, they are:
Audits
Completed audit reports for this project can be found at the links below.
Any unpatched or unresolved vulnerabilities disclosed in these reports are not eligible for rewards.
KYC required
The submission of KYC information is a requirement for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 3: Approval Required
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.