1inch Smart Contracts bug bounty on Immunefi
1inch pays up to $500,000 in USDC on Immunefi for bugs in its swap and limit order smart contracts. Live since June 11, 2026, rolling.
The 1inch Smart Contracts bug bounty runs on Immunefi. 1inch aggregates liquidity from many decentralized exchanges to find good token swap routes. The program went live on June 11, 2026 and was last updated on August 14, 2026. It has no end date.
Rewards depend on severity. Critical bugs pay 10% of the funds directly affected, from $30,000 up to $500,000. High bugs pay $10,000 to $30,000, medium bugs $2,000 to $10,000 and low bugs $100 to $2,000. Rewards are paid in USDC on Ethereum.
The scope covers the latest releases of several 1inch contract repositories on GitHub. They include the Limit Order Protocol, the Fusion settlement contracts, token plugins, farming, delegating, cross chain swap and the Solana cross chain protocol. A proof of concept is needed for every severity level.
You must pass KYC to get paid. People on the OFAC SDN list, official contributors, employees and auditors of 1inch cannot take part. 1inch runs six more bounties on Immunefi for its web apps, wallet, infrastructure, business products and Aqua contracts.
To report a bug, read the program rules on Immunefi and submit your report through the Immunefi platform.