1️⃣A Dutch auction that never dropped its price. Two separate researchers found it, from two separate angles, while Aqua was still pre-launch – and it is the clearest example of what a bug bounty is for.
Dutch auctions on Aqua start high and decay until a taker fills the order. Except the decay never ran. Xmanuel found that the decay factor was declared as a uint32, a number type too small for the 18-decimal precision the formula expected. The value was silently truncated and every decay curve came out flat. Bz went deeper and found that both balance instructions behind the auctions were non-functional. Makers who thought their orders were pricing themselves down over time were actually posting static limit orders, exposed for their whole lifetime to takers with better information. Both reports were paid as separate findings.
The only High of the half was sharper. Z3rco showed that MakerTraits hook flags are encoded one way and interpreted another during execution. A taker who crafted the encoding carefully could redirect maker funds inside a normal-looking swap. The report came with a working proof of concept. It was paid and resolved, and the fix is linked in the report.
None of this waited for launch. The bounty opened while Aqua was pre-launch: between January and June, 217 researchers filed 472 reports. Nine findings were paid and resolved: one High, one Medium, seven Low. Eight are broken down publicly, each with its commit.
Aqua is audited by eight independent teams including OpenZeppelin, Hexens and Decurity. The bounty runs on top of the audits, for what they might miss.
The full report walks through all eight public findings:
https://hackenproof.com/blog/1inch-bug-bounty-report-h1-2026
The program is still open and critical findings pay up to $100,000:
https://hackenproof.com/programs/1inch-aqua
Blog | X | YouTube | 1inch Wallet | Help Center