Executive Summary: 1Inch

Safety Rating: YELLOW

Overall Score: 6.1/10 | Confidence: 0.62 | Data Completeness: 0.75 "most domains report substantial data gaps"

Scores by Dimension

What This Protocol Does

1inch is described as a DeFi ecosystem and categorized here as a DEX aggregator "1inch is described in this workspace as a DeFi ecosystem" "category: DEX Aggregator". The technical evidence in this run is focused on the 1inch farming extension, where ERC20 holders can earn farming rewards while retaining control of tokens "The only technical source in this workspace is a security assessment focused on the 1inch farming extension" "It allows users to reap rewards from their holdings while still being in control of their tokens.".

Key Strengths

• Reviewed farming scope reported no critical/high/medium findings "Critical\n0" "High\n0" "Medium\n0".
• Some identified issues were fixed in specific commits "The issue was fixed by 1inch in commit e513e429." "The issue was fixed by 1inch in commit 29bf4aed.".
• Cross-analysis notes risk mitigators from the available audit outcomes "Available audit evidence reports no critical/high/medium findings in reviewed farming scope".
• Public website/GitHub/Twitter links are present in metadata "Workspace metadata includes website, GitHub, and Twitter links:".

Key Risks

• Governance/admin concentration risk remains due to owner-gated controls and missing governance-process detail "Single point of failure risk: Owner-gated controls can become concentrated power" "No governance docs/digests in this workspace to validate proposal flow, quorum, timelock, or upgrade path".
• Economic and integration blind spots remain for router-level behavior, oracle design, and MEV conditions "this workspace lacks current router-level evidence" "Insufficient data for this assessment from current workspace docs/digests.".
• Liquidity fragility signal is present from recent TVL trend "7d TVL delta is negative, which can increase liquidity fragility during volatility".
• Evidence confidence is reduced by sparse inputs and unverified audit publication provenance "Audit provenance is explicitly unverified" "uncertainty itself is a primary risk factor".

Critical Findings

• No critical findings identified in available reviewed scope "No critical findings reported in available audit data".

Recommendation

Current evidence supports a cautious, moderate-risk posture: suitable for users who understand DeFi operational risk and can tolerate incomplete governance/economic transparency in this dataset "moderate-but-uncertain" "significant cross-domain blind spots in governance process evidence, router-level economic exposure detail, and current social/transparency telemetry". More risk-sensitive users should wait for clearer governance documentation, broader and fresher audit coverage, and stronger current-state transparency signals "dataset is materially incomplete for a full governance assessment" "coverage is partial: one indexed audit with finding-level detail is available".

Report Sections

• Protocol Overview
• Code Security
• Economic Security
• Social & Team
• Governance
• Cross-Risk Analysis