1inch Business
By 1inch Bug bounty on HackenProof 1inch.com
- Top reward
- $100,000
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $100,000
- for critical bugs.
- Report on HackenProof
- Submit through the program page.
- Replies within 3 days
- As the policy promises.
- Payment
- Proof of identity needed to get paid.
- No public write-ups
- Keep findings private.
Rewards
What HackenProof lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$100,000 |
- Response
-
Within 3 days
First Response 3d
Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 1 excluded.
Web 2
- business.1inch.com/portal
- business.1inch.com/portal/documentation
APIs 1
- api.1inch.com
Domains 1
- business.1inch.com
Out of scope (1)
- Public API domains
Rules
What the policy asks of you, and the bug types it won't reward, quoted from 1inch Business (via HackenProof)'s policy.
While testing
-
AI-generated reports will not be considered
-
Automated scanning results will not be considered
-
Do not access or modify data belonging to other users
-
Non-production vulnerabilities are limited to High severity
-
Perform testing only within the scope described in this program
-
Do not spam forms or account creation flows using automated tools
-
Avoid compromising any personal data, interruption, or degradation of any service
-
Do not exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam methods
-
Remain compliant with all applicable laws and operate strictly within the defined testing scope
-
Avoid causing any disruption to the availability of products, services, or infrastructure
Not accepted
-
Recently (less than 30 days) disclosed zero-day vulnerabilities
-
Vulnerabilities affecting users of outdated browsers or platforms
-
Social engineering, phishing, physical, or other fraud activities
-
Publicly accessible login panels without proof of exploitation
-
Reports that simply identify outdated or vulnerable software without providing a valid proof of concept do not qualify.
-
Reports generated by automated scanners or exploit tools (without researcher analysis or actionable proof)
-
Vulnerabilities involving active content, such as web browser add-ons
-
Most brute-forcing issues
-
Denial of service (DoS/DDoS)
-
Missing HTTP security headers
-
Infrastructure vulnerabilities, including DNS issues (i.e., MX records, SPF records, DMARC records, etc.)
-
Open redirects (unless a serious impact is demonstrated)
-
Session fixation
-
User account enumeration
-
Descriptive error messages (e.g., stack traces, application or server errors)
-
Self-XSS that cannot be used to exploit other users
-
Login and logout CSRF
-
Weak captcha
-
HTTPOnly cookie flags
-
CSRF in forms that are available to anonymous users (e.g., contact forms)
-
OPTIONS/TRACE HTTP method enabled
-
Host header issues without proof-of-concept demonstrating a real impact
-
Content spoofing and text injection issues without a demonstrated attack vector, embedded links/HTML, or the ability to modify HTML/CSS
-
Reflected file download (RFD)
-
Mixed HTTP/HTTPS content
Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
business.1inch.com/portal/documentation
-
Scope removed
business.1inch.com/portal/
-
Scope removed
business.1inch.com/portal/documentation/
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackenproof.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Bug bounty Triaged by HackenProof 1inch Business: Program info 1inch Business Company: 1inch Scope Review: 314801 Submissions: 185 Total rewards: $34,200 Reputation 100 points required PoC Required Program is: active now Live Submit report Program info Hackers 77 Reports 0 The 1inch Business is a Web3 cloud SaaS (software as a service) platform offering multiple software services. All Scope Focus Area Program Rules Eligibility and Coordinated Disclosure Disclosure Guidelines Scope Search targets In scope Target │ Type │ Severity api.1inch.com Copy API │ Critical business.1inch.com/portal Copy Web │ Critical business.1inch.com/portal/documentation Copy Web │ Medium business.1inch.com Copy Web │ Medium Focus Area In-scope vulnerabilities The following vulnerabilities are considered in-scope: Business logic issues Payments manipulation Remote code execution (RCE) Injection vulnerabilities File inclusions Access control issues (e.g., IDOR) Server-side request forgery (SSRF) Cross-site request forgery (CSRF) Cross-site scripting (XSS) Rate limiting bypass (if subscription level limit is exceeded and it’s reproducible) Supply chain attack Cryptographic vulnerabilities Sensitive information disclosure Password management issues (e.g., OAuth) Session management issues (e.g., session stealing) Cloud misconfigurations Container security Cache poisoning Side-channel attacks Any other vulnerability with a clear potential for loss (such vulnerabilities will be considered at our discretion) All in-scope vulnerability reports must include a Proof of Concept (PoC) that demonstrates real-world impact. Submissions without a PoC will not be considered. Out-of-scope vulnerabilities Vulnerabilities identified in out-of-scope resources are generally not eligible for rewards unless they present a significant business risk, as determined at our sole discretion. The following items are generally excluded from reward eligibility due to insufficient severity or lack of relevance to the program’s defined scope: Recently (less than 30 days) disclosed zero-day vulnerabilities Vulnerabilities affecting users of outdated browsers or platforms Social engineering, phishing, physical, or other fraud activities Publicly accessible login panels without proof of exploitation Reports that simply identify outdated or vulnerable software without providing a valid proof of concept do not qualify. Reports generated by automated scanners or exploit tools (without researcher analysis or actionable proof) Vulnerabilities involving active content, such as web browser add-ons Most brute-forcing issues Denial of service (DoS/DDoS) Missing HTTP security headers Infrastructure vulnerabilities, including DNS issues (i.e., MX records, SPF records, DMARC records, etc.) Open redirects (unless a serious impact is demonstrated) Session fixation User account enumeration Descriptive error messages (e.g., stack traces, application or server errors) Self-XSS that cannot be used to exploit other users Login and logout CSRF Weak captcha HTTPOnly cookie flags CSRF in forms that are available to anonymous users (e.g., contact forms) OPTIONS/TRACE HTTP method enabled Host header issues without proof-of-concept demonstrating a real impact Content spoofing and text injection issues without a demonstrated attack vector, embedded links/HTML, or the ability to modify HTML/CSS Reflected file download (RFD) Mixed HTTP/HTTPS content Manipulation with password reset token (without real impact) Man-in-the-middle (MitM) and local attacks Public API domains Theoretical or purely speculative exploits without demonstrated business impact Program Rules AI-generated reports will not be considered Automated scanning results will not be considered Do not access or modify data belonging to other users Non-production vulnerabilities are limited to High severity Perform testing only within the scope described in this program Do not spam forms or account creation flows using automated tools Avoid compromising any personal data, interruption, or degradation of any service Do not exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam methods Remain compliant with all applicable laws and operate strictly within the defined testing scope Avoid causing any disruption to the availability of products, services, or infrastructure Bounty reward is determined by the proportion of potential damage and is limited by a severity rewards range Do not share details of any vulnerabilities with anyone outside the authorized team without explicit written permission from the organization Eligibility and Coordinated Disclosure We value all valid reports that help us strengthen our security. To qualify for a monetary reward, the following eligibility conditions must be fulfilled: The vulnerability must be a qualifying (in-scope) vulnerability Any vulnerability found must be reported no later than 24 hours after discovery Include clear and concise reproduction steps to help us verify and assess the impact of the reported issue efficiently You must be the first reporter of a vulnerability You must send a clear textual description of the report and detailed steps to reproduce the issue. Include attachments such as screenshots or proof-of-concept code if necessary You must not be a former or current employee of our company or any of its contractors Disclosure Guidelines All information related to this program, including any discovered vulnerabilities (resolved or unresolved), must be kept strictly confidential. Public disclosure — including partial disclosure or discussion in any public forum, channel, or platform — is strictly prohibited without the organization's explicit written consent Live since 23 Jun 2025 Published date 23 Jun 2025 Last updated 12 Aug 2026 Range of bounty $100 - $100,000 Severity Critical $30,000 - $100,000 High $10,000 - $30,000 Medium $2,000 - $10,000 Low $100 - $2,000 Infrastructure Web @Yahyaibr KYC Verified 1 @krainium KYC Verified 2 @hashes00 Verified 3 @MDPSEC Verified 4 @abylitron Verified 5 Response type Business days First Response 3d Triage Time 3d Reward Time 90d Resolution Time 14d