1inch Fee Extension audit
A private security review of 1inch (DEX aggregator), conducted with Sherlock and completed on 14th April 2025 over 4 days. 0xSimao disclosed 3 findings: 3 low.
What 1inch is
1inch's limit order protocol lets makers sign orders off-chain that takers fill on-chain, and the Fusion layer runs resolver auctions over those orders. The fee extension is the contract that computes and collects protocol and integrator fees, with whitelist discounts, at fill time.
Scope
The Sherlock review covered the fee extension contract: the taker-fee calculation and its rounding across order sizes and token decimals, the uni-transfer gas path, and the whitelist discount maths.
Low severity findings
- Taker fee is underestimated due to incorrect fee calculation
uniTransfer()limits the gas limit to 5k in outdated 1inch solidity-utils lib- Significant rounding error in whitelist discount that could be avoided
The report