All audits

Web3 · Smart Contract Audit

1inch

softstack has completed 7 smart contract audits for 1inch between November 2020 and October 2021, reporting 13 findings in total (2 medium, 3 low and 8 informational). Every report is published in the softstack public audit archive.

Key facts

Client
1inch
Audits completed
7
First audited
Latest audit
Type
Smart Contract Audit
Chains
BNB Chain, Polygon, Ethereum
Languages
Solidity
Market cap
$143M as of 2026-10-27

About the project

1inch is a decentralised exchange aggregator that routes trades across multiple liquidity sources to secure rates better than a single venue offers. The network extends to a self-custodial wallet, portfolio tracking and a payment card built on the same open-source, onchain protocols. It operates on Ethereum, BNB Chain, Polygon and other supported networks.

Findings

Combined across all 7 reviews softstack has completed for 1inch. Each report is broken out below.

0Critical
0High
2Medium
3Low
8Informational

Reports

Newest first. Every report covers its own scope and commit.

  1. Limit Order Protocol v2 smart contract audit

    · commit 9d11830 · 3 files

    PDF
    0Critical
    0High
    0Medium
    0Low
    0Informational

    No security findings reported.

    ScopeSource repositorygithub.com/1inch/limit-order-protocol

    Components reviewed

    3 modules · 3 files
    1. LimitOrderProtocol.sol
    2. OrderMixin.sol
    3. OrderRFQMixin.sol

  2. Router & RFQ v4 smart contract audit

    · 1 file

    PDF
    0Critical
    0High
    0Medium
    0Low
    1Informational

    0 of 1 resolved

    Scope

    Components reviewed

    1 module · 1 file
    1. AggregationRouterV4.sol
    All 1 findings
    IDTitleSeverityStatus
    5.1.1Extensive owner rights

    Code Snippet Result/Recommendation The owner has extensive rights, which can lead to a vulnerability once the private key got lost or hacked. This is the case if the access to the owner wallet is not a multi-sig.

    		Informationalacknowledged

  3. Cumulative Merkle Drop smart contract audit

    · 1 file

    PDF
    0Critical
    0High
    0Medium
    0Low
    0Informational

    No security findings reported.

    Scope

    Components reviewed

    1 module · 1 file
    1. CumulativeMerkleDrop.sol

  4. Limit Order Protocol (Re-check after compiler downgrade to 0.7.6) smart contract audit

    · 1 file

    PDF
    0Critical
    0High
    0Medium
    0Low
    0Informational

    No security findings reported.

    ScopeSource repositorygithub.com/1inch/limit-order-protocol

    Components reviewed

    1 module · 1 file
    1. LimitOrderProtocol.sol

  5. Limit Order Protocol smart contract audit

    · 1 file

    PDF
    0Critical
    0High
    0Medium
    0Low
    0Informational

    No security findings reported.

    Scope

    Components reviewed

    1 module · 1 file
    1. LimitOrderProtocol.sol

  6. Mooniswap V2 & 1INCH Token smart contract audit

    · commit 648157b · 25 files

    PDF
    0Critical
    0High
    2Medium
    3Low
    4Informational
    ScopeSource repositorygithub.com/1inch-exchange/mooniswap-v2

    Components reviewed

    14 modules · 25 files
    1. governance/BaseGovernanceModule.sol
    2. governance/GovernanceFeeReceiver.sol
    3. governance/MooniswapFactoryGovernance.sol
    4. b6897544aafc9fbe51fb3a768899egovernance/MooniswapGovernance.sol
    5. d2da174d0d92fc45e63eadbbb8a9da5bgovernance/rewards/IRewardDistributionRecipient.sol
    6. governance/rewards/Rewards.sol
    7. inch/GovernanceMothership.sol
    8. interfaces/IGovernanceModule.sol
    9. f2dd63a8e644bf85e5e31710459606ecinterfaces/IMooniswapDeployer.sol
    10. interfaces/IMooniswapFactoryGovernance.sol
    11. e79b4b78ed8554dd8349aed6fe64cbinterfaces/IReferralFeeReceiver.sol
    12. db0c64ea1b01385f418f2feca6e8d1fclibaries/LiquidVoting.sol
    13. libaries/Sqrt.sol
    14. libaries/UniERC20.sol
    All 7 findings
    IDTitleSeverityStatus
    5.1.1Cannot pause / shutdown Mooniswap Factory

    Code Snippet Result/Recommendation The Mooniswap.sol contract needs a mechanism for the owner to pause the contract. This disables the swap functionality. However, there is no corresponding mechanism to shutdown the contract.

    		Mediumfixed
    5.1.2Potential violation of Checks-Effects-Interaction pattern

    Code Snippet Result/Recommendation Potential violation of Checks- Effects-Interaction pattern. Could potentially lead to re- entrancy vulnerability.

    		Mediumfixed
    5.1.3Potential front running attack or losing of allowance

    Code Snippet Result/Recommendation The _approve method replaces the allowance, so there are two potential problems here: 1.

    		Lowacknowledged
    5.1.4Mismatch of argument name in _PERMIT_TYPEHASH and permit function

    Code Snippet Result/Recommendation At the line ERC20Permit.sol#L27 the value argument is used but at the line ERC20Permit.sol#L32 the argument name is amount .

    		Lowfixed
    5.1.5Use SafeCast library for uintXX/intXX wrapper

    Code Snippet Result/Recommendation Wrappers over Solidity's uintXX/intXX casting operators with added overflow checks. Downcasting from uint256/int256 in Solidity does not revert on overflow.

    		Lowfixed
    5.1.7Fix Spelling and Grammatical Errors

    Code Snippet Result/Recommendation Language mistakes were identified in the messages in the codebase.

    		Informationalfixed
    5.1.9"dist:factory": "truffle-flattener Mooni* (rename)

    Code Snippet Result/Recommendation Failed at the @1inch/mooniswap@0.0.1 dist:factory script. Line: 43 "dist:factory": "truffle-flattener ./contracts/MooniFactory.sol | awk '/SPDX- License-Identifier/&&c++>0 {next} 1' >…

    		Informationalfixed

  7. Exchange Contracts smart contract audit

    · 12 files

    PDF
    0Critical
    0High
    0Medium
    0Low
    3Informational
    Scope

    Components reviewed

    12 modules · 12 files
    1. OneInchExchange.sol
    2. OneInchFlags.sol
    3. RevertReasonParser.sol
    4. UniERC20.sol
    5. IOneInchCaller.sol
    6. IERC20Permit.sol
    7. IChi.sol
    8. OneInchExchange.solhelpers/RevertReasonParser.solhelpers/UniERC20.sol
    9. Interfaces/IOneInchCaller.sol
    10. Interfaces/IERC20Permit.sol
    11. Interfaces/IChi.sol
    12. helpers/UniERC20.sol

  8. Mooniswap V2 & 1INCH Token smart contract audit

    · commit 648157b · 35 files

    PDF

    Earlier issue of the same review. Its findings are counted once in the combined total above.

    0Critical
    0High
    2Medium
    3Low
    4Informational
    ScopeSource repositorygithub.com/1inch-exchange/mooniswap-v2

    Components reviewed

    14 modules · 35 files
    1. governance/BaseGovernanceModule.sol
    2. governance/ExchangeGovernance.sol
    3. governance/GovernanceFeeReceiver.sol
    4. governance/GovernanceRewards.sol
    5. governance/MooniswapFactoryGovernance.sol
    6. governance/MooniswapGovernance.sol
    7. farming/FarmingRewards.sol
    8. inch/GovernanceMothership.sol
    9. D56E80B545EF47C357EE7D85C9D9Dinterfaces/IExchangeGovernance.sol
    10. B2C61C7F531C6748C9A7F282B37B632Cinterfaces/IFeeCollector.sol
    11. interfaces/IGovernanceModule.sol
    12. C394F645331661AF1D2372F6E62Binterfaces/IMooniswapDeployer.sol
    13. interfaces/IMooniswapFactory.sol
    14. interfaces/IMooniswapFactoryGovernance.sol
    All 7 findings
    IDTitleSeverityStatus
    5.1.1Cannot pause / shutdown Mooniswap Factory

    Code Snippet Result/Recommendation The Mooniswap.sol contract needs a mechanism for the owner to pause the contract. This disables the swap functionality. However, there is no corresponding mechanism to shutdown the contract.

    		Mediumfixed
    5.1.2Potential violation of Checks-Effects-Interaction pattern

    Code Snippet Result/Recommendation Potential violation of Checks- Effects-Interaction pattern. Could potentially lead to re- entrancy vulnerability.

    		Mediumfixed
    5.1.3Potential front running attack or losing of allowance

    Code Snippet Result/Recommendation The _approve method replaces the allowance, so there are two potential problems here: 1.

    		Lowacknowledged
    5.1.4Mismatch of argument name in _PERMIT_TYPEHASH and permit function

    Code Snippet Result/Recommendation At the line ERC20Permit.sol#L27 the value argument is used but at the line ERC20Permit.sol#L32 the argument name is amount .

    		Lowfixed
    5.1.5Use SafeCast library for uintXX/intXX wrapper

    Code Snippet Result/Recommendation Wrappers over Solidity's uintXX/intXX casting operators with added overflow checks. Downcasting from uint256/int256 in Solidity does not revert on overflow.

    		Lowfixed
    5.1.7Fix Spelling and Grammatical Errors

    Code Snippet Result/Recommendation Language mistakes were identified in the messages in the codebase.

    		Informationalfixed
    5.1.9"dist:factory": "truffle-flattener Mooni* (rename)

    Code Snippet Result/Recommendation Failed at the @1inch/mooniswap@0.0.1 dist:factory script. Line: 43 "dist:factory": "truffle-flattener ./contracts/MooniFactory.sol | awk '/SPDX- License-Identifier/&&c++>0 {next} 1' >…

    		Informationalfixed

Methodology

Review process

  1. Scoping and threat modelling

    The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.

  2. Automated analysis

    Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.

  3. Manual code review

    Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.

  4. Adversarial testing

    Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.

  5. Reporting

    Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.

  6. Remediation verification

    Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.

Standards and references

  • SWC RegistrySmart Contract Weakness Classification
  • CWECommon Weakness Enumeration

FAQ

7 separate reviews, the first in November 2020 and the most recent in October 2021. Each one covers its own scope and commit, and is listed individually on this page.

13 findings across all 7 reviews: 2 medium, 3 low and 8 informational.

Each report covers the code as it stood at the commit it names, the most recent in October 2021. Any code changed after that point is outside the reviewed scope.

Disclaimer

This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.