1inch Advances DeFi Security With Biannual Bug Bounty Transparency Reports
1inch Network has unveiled a biannual bug bounty reporting initiative developed in partnership with HackenProof, with the inaugural publication examining the Aqua program and first-half 2026 bounty activities.
The emergence of institutional-grade decentralized finance represents a significant expansion as traditional financial institutions increasingly participate in the digital asset market. Nevertheless, establishing trust continues to present a substantial challenge. In response, 1inch has pursued multiple transparency and security measures, including a recently updated second edition of its Risk Management Whitepaper, ISO and SOC 2 certifications, and the newly introduced biannual bug bounty report series.
Each installment of the reporting series will examine a specific program or operational domain, offering the community expanded context regarding operational mechanisms and potential vulnerability areas. The publications will also include supplementary technical details designed to assist security researchers in optimizing their contributions to the ecosystem.
Aqua Program: Security Architecture for Shared Liquidity
During the first half of 2026, 1inch’s six primary HackenProof bug bounty programs collectively received 1,055 submissions from security researchers, resulting in 32 validated payouts distributed across various severity classifications. The 1inch Smart Contract program generated 267 reports from 122 researchers, yielding three paid findings.
The 1inch Wallet program produced 85 reports from 67 researchers, with six resulting in compensation. The 1inch Web initiative received 68 reports from 45 researchers, leading to one paid report. The 1inch Business program accounted for 111 reports from 89 researchers, with nine validated payouts. The 1inch Infrastructure program drew 52 reports from 45 researchers, producing four paid findings. The Aqua program attracted the highest engagement, with 472 reports submitted by 217 researchers, nine of which received rewards.
The initial report provides comprehensive analysis of Aqua, 1inch’s recently introduced shared liquidity layer, which the company describes as the first of its kind. Since its public launch, Aqua has demonstrated rapid adoption, exceeding $100 million in transaction volume within weeks. The platform’s security foundation, however, was established through extensive pre-launch scrutiny, with its HackenProof bug bounty program attracting substantial researcher attention and contributing to product security from inception.
The Aqua Bug Bounty program recorded significant community participation, with 472 submissions from 217 researchers addressing vulnerabilities across multiple severity levels. Nine vulnerabilities qualified for rewards in this reporting period, encompassing one high-severity issue alongside several medium and low-severity findings.
The identified issues included logic inconsistencies, unit mismatches, execution edge cases, and tooling-related problems. All reported vulnerabilities have since been remediated, enhancing protocol stability and security.
“Institutional-grade DeFi requires proactively adopting standards that go past what is prescribed,” comments Sergej Kunz, co-founder of 1inch in a written statement. “The industry needs to go beyond the minimum to ensure products are secure and reliable. With Aqua, as with all our products, we put multiple layers of checks and testing in place from the start, and bug bounties are a key part of that approach,” he added.
“Aqua’s approach to security highlights the value of making security an ongoing part of product development,” said Alex Horlan, CTO of HackenProof in a written statement. “Its bug bounty program provides continuous visibility into potential security risks as the product evolves, helping the team strengthen the protocol and reduce the likelihood of costly security incidents,” he added.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
