Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

1inch - Aqua Improvement

By 1inch Bug bounty on Immunefi 1inch.com

Accepting reports KYC to get paid web3
Go to program Website
Top reward
$25,000
Top severity paid
Low
Assets in scope
34
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $25,000
for low bugs, from $100.
Report on Immunefi
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Paid by USDC on Ethereum
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Immunefi lists as the payout for each severity.

Severity Reward
Low $25,000 from $100
Safe harbor
Partial Provides safe harbor against claims under applicable computer fraud and copyright statutes (including but not limited to ARSL, EULA, DMCA, and CFAA) for actions taken in good faith and in compliance with the rules of this program

Summarised with AI from the program policy on Immunefi, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

34 assets you may test, 3 excluded.

Source code 34

  • aqua
  • https://github.com/1inch/aqua/blob/v1.0.0/src/AquaRouter.sol
  • https://github.com/1inch/aqua/blob/v1.0.0/src/Aqua.sol
  • https://github.com/1inch/aqua/blob/v1.0.0/src/libs/Balance.sol
  • https://github.com/1inch/solidity-utils/blob/6.9.16/contracts/libraries/Calldata.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/CalldataPtr.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/ECDSA.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/RevertReasonForwarder.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/SafeERC20.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/StringUtil.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/TransientLock.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/Transient.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/UniERC20.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/EthReceiver.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/Multicall.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/OnlyWethReceiver.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/Rescuable.sol
  • https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/Simulator.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Balances.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Controls.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Decay.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Extruction.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Fee.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/PeggedSwap.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/XYCConcentrate.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/XYCSwap.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/MakerTraits.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/PeggedSwapMath.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/TakerTraits.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/VM.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/opcodes/AquaOpcodes.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/routers/AquaSwapVMRouter.sol
  • https://github.com/1inch/swap-vm/blob/v1.0.2/src/SwapVM.sol
  • swap-vm
Out of scope (3)
  • solidity-utils repository
  • src/strategies/AquaAMM.sol
  • https://github.com/1inch/sdks

Rules

What the policy asks of you, and the bug types it won't reward, quoted from 1inch - Aqua Improvement (via Immunefi)'s policy.

While testing

  • A PoC is required for this program and has to comply with the Immunefi PoC Guidelines and Rules .
  • Is limited to local development environments, local forks, and testnets — production deployments and live mainnet usage are prohibited
  • Publishing or distributing modified versions of Aqua source code, binaries, or compiled artifacts in any form is prohibited, both during and after the embargoed period.
  • Improvement proposals are accepted only for the aqua and swap-vm repositories.

Not accepted

  • Any improvement suggestions mentioned in these reports are not eligible for a reward.
  • Vulnerabilities or improvements affecting this file are not eligible for rewards.
  • The solidity-utils repository is excluded from improvement proposals.

Summarised with AI from the program policy on Immunefi, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 24 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Reward terms

    The reward table or payout terms were edited

  2. Reward terms

    The reward table or payout terms were edited

  3. Scope removed

    https://github.com/1inch/swap-vm/blob/main/src/instructions/Balances.sol

  4. Scope removed

    https://github.com/1inch/solidity-utils/blob/master/contracts/libraries/RevertReasonForwarder.sol

  5. Scope removed

    https://github.com/1inch/solidity-utils/blob/master/contracts/libraries/CalldataPtr.sol

  6. Scope removed

    https://github.com/1inch/aqua/blob/main/src/libs/Balance.sol

  7. Scope added

    https://github.com/1inch/solidity-utils/blob/6.9.16/contracts/libraries/Calldata.sol

  8. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/Simulator.sol

  9. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/Rescuable.sol

  10. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/OnlyWethReceiver.sol

  11. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/Multicall.sol

  12. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/mixins/EthReceiver.sol

  13. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/UniERC20.sol

  14. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/TransientLock.sol

  15. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/Transient.sol

  16. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/StringUtil.sol

  17. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/SafeERC20.sol

  18. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/RevertReasonForwarder.sol

  19. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/ECDSA.sol

  20. Scope added

    https://github.com/1inch/solidity-utils/blob/7.0.0/contracts/libraries/CalldataPtr.sol

  21. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/routers/AquaSwapVMRouter.sol

  22. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/opcodes/AquaOpcodes.sol

  23. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/VM.sol

  24. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/TakerTraits.sol

  25. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/PeggedSwapMath.sol

  26. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/libs/MakerTraits.sol

  27. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/XYCSwap.sol

  28. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/XYCConcentrate.sol

  29. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/PeggedSwap.sol

  30. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Fee.sol

  31. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Extruction.sol

  32. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Decay.sol

  33. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Controls.sol

  34. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/instructions/Balances.sol

  35. Scope added

    https://github.com/1inch/swap-vm/blob/v1.0.2/src/SwapVM.sol

  36. Scope added

    https://github.com/1inch/aqua/blob/v1.0.0/src/libs/Balance.sol

  37. Scope added

    https://github.com/1inch/aqua/blob/v1.0.0/src/AquaRouter.sol

  38. Scope added

    https://github.com/1inch/aqua/blob/v1.0.0/src/Aqua.sol

  39. Scope removed

    https://github.com/1inch/swap-vm/blob/main/src/instructions/XYCConcentrate.sol

  40. Scope removed

    https://github.com/1inch/swap-vm/blob/main/src/instructions/PeggedSwap.sol

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from immunefi.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Back to Explore 1inch - Aqua Improvement | 1inch Aqua is a decentralized protocol for creating and managing custom liquidity positions with flexible strategies and advanced features. However, unlike the primary Aqua bug bounty program, this focuses on improvements only that would otherwise be out of scope. Maximum Bounty $25,000 Live Since 11 June 2026 Last Updated 11 November 2026 Triaged by Immunefi PoC Required KYC required Submit a Bug Information Scope Resources Rewards 1inch - Aqua Improvement provides rewards in USDC on Ethereum , denominated in USD. Rewards by Threat Level Smart Contract Low Max: $25,000 Min: $100 Primacy of Rules Primacy of Impact vs Primacy of Rules 1inch - Aqua Improvement adheres to the Primacy of Rules, which means that the whole bug bounty program is run strictly under the terms and conditions stated within this page. Repeatable Attack Limitations If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward. The amount of funds at risk will be calculated with the impact of the first attack being at 100% and then a reduction of 50 % from the amount of the first attack for every 24 hours the attack needs for subsequent attacks from the first attack, rounded down. Rewards Body Proof of Concept (PoC) Requirements A PoC is required for this program and has to comply with the Immunefi PoC Guidelines and Rules . A demonstration of the proposal's value is required for this program. Depending on the type of improvement, this may take the form of: Before/after benchmarks (for gas optimizations or performance improvements) Test cases demonstrating accounting/invariant correctness A minimal reproducible example showing the integration issue or hardening gap A brief implementation outline demonstrating how the change would be applied Previous Audits 1inch’s completed audit reports can be found at https://github.com/1inch/1inch-audits . Any improvement suggestions mentioned in these reports are not eligible for a reward. Rewards by Threat Level Rewards are distributed according to the Impacts in Scope table. Reward Calculation for All Reports Reports under this program follow a goodwill payout process. There is no guaranteed minimum reward — 1inch retains full discretion on whether to provide a reward for any submitted improvement suggestion, and on the exact amount within the range of USD 100 to USD 25000 based on the demonstrated value of the proposal. Submission of a proposal does not entitle the proposer to a reward. Other Limitations and Requirements https://github.com/1inch/sdks asset is out-of-scope. Within the https://github.com/1inch/swap-vm asset, the file src/strategies/AquaAMM.sol is explicitly out of scope. Vulnerabilities or improvements affecting this file are not eligible for rewards. This license applies only to the assets explicitly listed in scope and does not extend to any other 1inch property or third-party dependencies. Publishing or distributing modified versions of Aqua source code, binaries, or compiled artifacts in any form is prohibited, both during and after the embargoed period. After coordinated disclosure, only minimal technical details necessary to describe the vulnerability or fix may be shared, and only with prior written approval from 1inch consistent with the Responsible Publication policy above. Each proposal should describe the rationale and expected impact, identify affected contracts or components, outline minimal tests and benchmarks, and, if relevant, note any migration considerations. A good PoC typically includes clear before/after evidence, a minimal reproducible example, and a brief implementation outline demonstrating how the change would be applied. Improvement proposals are accepted only for the aqua and swap-vm repositories. The solidity-utils repository is excluded from improvement proposals. Improvement proposals may be applied to the main branch. Immunefi Mediations are not possible with this bug bounty program as it only covers improvement suggestions. Any request for mediation will be closed. Research License Participants are granted a limited, non-exclusive, non-transferable license to compile, deploy, and test the Aqua codebase listed in the Assets in Scope table solely for the purpose of identifying vulnerabilities under this bug bounty program. This license: Is limited to local development environments, local forks, and testnets — production deployments and live mainnet usage are prohibited Does not permit redistribution, sublicensing, or commercial use of the code Does not transfer any intellectual property rights Provides safe harbor against claims under applicable computer fraud and copyright statutes (including but not limited to ARSL, EULA, DMCA, and CFAA) for actions taken in good faith and in compliance with the rules of this program Auto-terminates upon any breach of program rules, after which the safe harbor no longer applies and 1inch reserves all rights This license applies only to the assets explicitly listed in scope and does not extend to any other 1inch property or third-party dependencies. Publishing or distributing modified versions of Aqua source code, binaries, or compiled artifacts in any form is prohibited, both during and after the embargoed period. After coordinated disclosure, only minimal technical details necessary to describe the vulnerability or fix may be shared, and only with prior written approval from 1inch consistent with the Responsible Publication policy above. Reward Payment Terms Payouts are handled by the 1inch team directly and are denominated in USD. However, payments are done in USDC on Ethereum. The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability. Reports and payout details may be checked against OFAC, EU, and UK sanctions lists prior to payment. Payment may be withheld, delayed, or refused entirely if prohibited by applicable law, sanctions regimes, or 1inch's compliance obligations. Researchers are responsible for ensuring their participation does not violate the laws of their jurisdiction. View impacts in scope Program Overview For more information about 1inch, please visit https://1inch.com/ . 1inch provides rewards in USDC on Ethereum, denominated in USD. For more details about the payment process, please view the Rewards by Threat Level section further below. 1inch maintains six additional bug bounty programs on Immunefi. In addition to this, they are: 1inch Infrastructure 1inch Aqua 1inch Smart Contract 1inch Web 1inch Wallet 1inch Business Audits Completed audit reports for this project can be found at the links below. Any unpatched or unresolved vulnerabilities disclosed in these reports are not eligible for rewards. Auditor Link Completed at All Audits │ https://github.com/1inch/1inch-audits │ 11 June 2026 Auditor All Audits Link https://github.com/1inch/1inch-audits Completed at 11 June 2026 KYC required The submission of KYC information is a requirement for payout processing. Participants must adhere to the Eligibility Criteria. Proof of Concept Proof of concept is always required for all severities. Responsible Publication Category 3: Approval Required Feasibility Limitations The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity. Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report. Chain Rollbacks Pre-Impact Bug Monitoring Attack Investment Amount Attacks With A Financial Risk To The Attacker When Is An Impactful Attack Downgraded To Griefing? Submit a Bug Total Assets in Scope 32