Audit name:
[PT] 1inch | Web | Nov2025
Date:
Feb 13, 2026
Table of Content
Introduction
We express our gratitude to the 1inch team for the collaborative engagement that enabled the execution of this Pentest.
1inch is a decentralized exchange (DEX) aggregator that sources liquidity across multiple DeFi protocols to provide users with the best possible trading rates. It optimizes trades by splitting orders across venues, reducing slippage and improving capital efficiency on supported blockchains.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for 1inch |
| Audited By | Faizan Nehal |
| Approved By | Stephen Ajayi |
| Website | https://1inch.com→ |
| Changelog | 27/01/2026 - Preliminary Report |
| Changelog | 13/02/2026 - Final Report |
| Platform | Web Application |
| Methodology | https://docs.hacken.io/methodologies/pentesting→ |
Document
- Name
- Pentest and Security Analysis Report for 1inch
- Audited By
- Faizan Nehal
- Approved By
- Stephen Ajayi
- Website
- https://1inch.com→
- Changelog
- 27/01/2026 - Preliminary Report
- Changelog
- 13/02/2026 - Final Report
- Platform
- Web Application
Review Scope | |
|---|---|
| Staging Environment | https://business-staging.1inch.com→ |
| Production Environment | https://business.1inch.com→ |
Review Scope
- Staging Environment
- https://business-staging.1inch.com→
- Production Environment
- https://business.1inch.com→
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
1inch Business is a Web3 infrastructure platform provided by the 1inch ecosystem that offers a comprehensive suite of blockchain and DeFi APIs for developers, startups, enterprises, and financial institutions. It enables teams to integrate decentralized finance (DeFi) capabilities into their applications with reliable, scalable API services covering token swaps, price data, balances, transaction history, portfolio analytics, gas price information, and more.
The platform serves as an evolution of the former 1inch Developer Portal, now rebranded and expanded to support enterprise-grade DeFi integrations with improved documentation, SDKs, and technical support. It is designed to simplify interaction with deep liquidity sources and optimal routing logic from the broader 1inch ecosystem, allowing builders to focus on strategy and innovation rather than backend DeFi complexity.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2026-1485 | Missing Strict-Transport-Security Header | accepted | Observation | |
| F-2026-1485 | Missing Server-side Length Validation for Billing Address Information | fixed | Observation | |
| F-2026-1485 | Missing Server-side Length Limits for Company Information Parameters | fixed | Observation |
Appendix 1. Severity Definitions
Findings are categorized based on their potential impact and assigned a severity level using the Common Vulnerability Scoring System (CVSS) version 4.0: →
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| Staging Environment | https://business-staging.1inch.com→ |
| Production Environment | https://business.1inch.com→ |
Scope Details
- Staging Environment
- https://business-staging.1inch.com→
- Production Environment
- https://business.1inch.com→
Appendix 3. Additional Valuables
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, the Penetration Testing Execution Standard (PTES) →, and the OWASP Testing Guide →. These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.