Do not report security vulnerabilities through public GitHub issues, pull requests or discussions. A public report gives an attacker the same information it gives us, before there is a fix.
Report privately to security@1inch.com.
Acknowledgement times and response SLAs change the same way programme rules do — read them on the bug bounty pages linked below rather than trusting a copy here.
Please include the affected contract and network, the commit or tag the deployment was built from, and the steps or a test that reproduces the problem.
Smart-contract findings go through the 1inch bug bounty programmes. Scope, severity levels, payout ranges and response SLAs live on the programme pages — they change, so this file links them rather than copying them:
See deployments.md for the contracts and networks covered by this policy.
- Aqua and SwapVM v1.0.2: Bailsec, Decurity, MixBytes, OpenZeppelin, Theori
- Aqua and SwapVM v1: Bailsec, Decurity, Hashlock, Hexens, MixBytes, Nethermind, OpenZeppelin, Theori
Findings acknowledged without a code change are recorded, with the team's response, in the audit reports above.
Security-related roles are listed at 1inch open positions.