1Inch Resolve Order Suffix Integer Overflow Vulnerability

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

1Inch Logo/Homepage

1inch, a decentralized finance platform, offers tools for optimizing trades across multiple networks, swapping tokens, and managing assets securely, while also emphasizing its commitment to security and compliance. The platform's older Fusion V1 protocol, though deprecated, became the target of a vulnerability that allowed an attacker to exploit a bug in the resolver contract, draining millions of dollars. Despite several audits, the flaw remained undetected for over two years. After a series of negotiations, most of the stolen funds were returned, minus a 10% bounty.

About 1Inch Exchange

"One-stop access to decentralized finance" "Optimize your trades across hundreds of DEXes on multiple networks" "A tool for swapping tokens across any network and placing on-chain limit orders securely, at the best rate." "The most powerful mobile app for managing your assets and exploring Web3." "A cutting-edge tracking tool offering accurate, detailed and well-organized crypto portfolio information."

"1inch is dedicated to advancing a secure and compliant DeFi ecosystem. By uniting with forefront security and compliance specialists, we set the standard for safety and compliance, ensuring our users navigate the DeFi space with confidence."

1Inch Exchange has maintained a bug bounty program where users can submit bug reports and be rewarded up to $500,000, which has been present since at least July 2024.

The Reality

Despite several audits having been completed, a vulnerability remained present in the 1inch smart contract in the deprecated _settleOrder function, which had been part of the protocol’s earlier architecture. Despite multiple audits, the vulnerability remained undetected for over two years.

What Happened

A vulnerability in 1inch's deprecated Fusion V1 contracts allowed an attacker to exploit a calldata corruption issue, stealing $5 million by using a simple integer overflow trick.

Key Event Timeline - 1Inch Resolve Order Suffix Integer Overflow Vulnerability

Date	Event	Description
March 5th, 2025 10:15:23 AM MST	First Attack Transaction Occurs	The first attack transaction on the Ethereum blockchain.
March 5th, 2025 10:31:00 AM MST	Decurity Team Alerted	The Decurity team "noticed a hack alert related to 1inch in the Defimon dashboard and Telegram channel".
March 5th, 2025 10:38:00 AM MST	Decurity Team Investigation	The Decurity team "started looking into it, some funds were still intact, the reason was unclear".
March 5th, 2025 10:47:00 AM MST	Decurity Team Confusion	The Decurity team notes their confusion at the time. "Someone made bad trades on 1inch or got phished?"
March 5th, 2025 10:53:00 AM MST	Decurity Team Conclusion	The Decurity team "decided that this is a bug in the resolver’s implementation."
March 5th, 2025 10:54:35 AM MST	Final Attack Transaction Occurs	The final attack transaction in the sequence. As Decurity team notes, "The hacker finished draining the funds.".
March 5th, 2025 10:55:00 AM MST	Decurity Team Notifies 1Inch	The Decurity team "became confident this is a 3rd party resolver hack and notified the 1inch team".
March 5th, 2025 11:10:00 AM MST	Decurity Team Joins War Room	The Decurity team "joined the war room, started brainstorming the reasons and looking for other affected resolver implementations".
March 5th, 2025 11:34:23 AM MST	Attacker Requests For Bounty	The attacker sent an on-chain message via IDM "Can I have bounty?".
March 5th, 2025 11:51:11 AM MST	1Inch Team Responds About Bounty	The 1Inch team responds via the IDM messaging system, providing the attacker with a Telegram chat channel "trustedvolumes".
March 5th, 2025 1:01:11 PM MST	1Inch Team Provides Alternative	The 1Inch team provides the attacker with an alternative means of contacting them via a ProtonMail email address.
March 5th, 2025 3:00:00 PM MST	1Inch Team Discovers Vulnerability	The 1Inch Exchange team uses this as the official timestamp where they report that they have discovered the vulnerability itself.
March 5th, 2025 4:40:00 PM MST	Decurity Root Cause Analysis	The Decurity team "finished the analysis and identified the root cause and exploit mechanics".
March 5th, 2025 4:55:35 PM MST	Bounty Negotations Officially Completed	The 1Inch team notes in an IDM that they're reached an agreement with the attacker for a bug bounty of $450k. The official refund address is provided. Decurity notes this as the "negotiations concluded successfully".
March 5th, 2025 4:59:59 PM MST	Return Of USDC Funds From Exploit	The attacker returns 2,400,000 USDC to the official refund address.
March 5th, 2025 5:02:35 PM MST	Return Of WETH Funds From Exploit	The attacker returns 1,076 WETH to the official refund address.
March 5th, 2025 9:12:00 PM MST	Reported Return Of All Funds	Decurity notes that "The attacker returned all the funds except for a fractional bounty." However, it's unclear what other transactions are involved in the return of funds.
March 6th, 2025 10:06:00 AM MST	1Inch Exchange Announcement	1Inch Exchange posts an update to Twitter, informing the community about a vulnerability in resolver smart contracts utilizing the obsolete Fusion v1 implementation. They emphasized that no end-user funds were at risk, and only the resolvers using Fusion v1 in their own contracts were affected. 1inch reassured the public that they were actively collaborating with the affected resolvers to secure their systems and urged all resolvers to audit and update their contracts immediately. Additionally, they provided information on the bug bounty program and details related to funds return.
March 7th, 2025 10:38:48 AM MST	Decurity PostMortem Published	Decurity publishes a post-mortem revealing that the attack exploited a vulnerability in the order suffix processing of 1inch's older Fusion V1 protocol, enabling an attacker to overwrite the resolver address and call arbitrary resolvers. This led to a loss for market maker TrustedVolumes, but after negotiations, most of the funds were returned, with only a fractional bounty remaining. The post-mortem reveals that despite multiple audits, the vulnerability went unnoticed for over two years, largely due to the code's evolution and lack of attention to the resolver contract. It emphasizes lessons learned about audit scope, threat modeling, and the importance of real-time threat detection and post-deployment security.
March 13th, 2025 1:54:00 PM MDT	Rekt News Article Published	Rekt News publishes an article, describing the exploit turning 1Inch into a $5 million "ATM" through a negative integer underflow. The attacker discovered that by setting an interaction length to -512, they could manipulate memory pointers, hijack resolver addresses, and steal funds. Despite the vulnerability being missed by nine audit teams over two years, the hacker managed to steal approximately $4.5 million, later returning most of it after negotiating a bounty with the affected parties. The attack exposed fundamental flaws in security audits, with the vulnerability being traced back to a simple buffer overflow missed during multiple rounds of code reviews.

Technical Details

The core issue was that the vulnerability was a basic arithmetic error—an integer underflow—that should have been easily caught by any thorough security check.

The issue was a calldata corruption that allowed an attacker to exploit a negative interaction length (set to -512), triggering an integer underflow. This caused memory pointers to underflow, redirecting function calls and giving the attacker control over the resolver contracts, enabling them to steal funds.

The exploit was deceptively simple, relying on basic arithmetic manipulation—specifically, a negative number in the calldata—to bypass security measures. By creating seemingly normal transactions padded with null bytes and setting the interaction length to the negative value, the attacker could hijack memory pointers and redirect control, ultimately siphoning off millions in stolen funds.

"The exploit targeted a third-party resolver contract integrated with the the Fusion V1 protocol. 1inch Fusion is an efficient gasless swap protocol built on top of 1inch Limit Order Protocol. Fusion V1 was deprecated mid-2023 but was not destructed for the purpose of backwards compatibility for the users who still needed the old version."

"The attacker used the following approach:

Create a normal order swapping a few wei for millions USD. Pad it with null-bytes. Specify an invalid interactionLength value (0xffff…fe00 = -512). Add a fake suffix structure as an interaction."

Attack transactions:

Total Amount Lost

"The final tally: TrustedVolumes got most of their $4.5M back minus the 10% 'bounty' the attacker kept ($450K), while smaller market makers collectively lost around $500K."

SlowMist, a security firm, conducted a follow-up investigation and reports that 2.4 million USDC and 1,276 WETH was missing.

The total amount lost has been estimated at $5,000,000 USD.

Immediate Reactions

On March 6, 2025, 1Inch Exchange issued an announcement about a vulnerability in their obsolete Fusion v1 resolver contracts, which were part of their earlier system. In this statement, they reassured the public that "no end-user funds were at risk" and seemed to downplay the severity of the situation. It appeared to be just another routine patch for outdated code.

At 23:00 CET on 05.03.25, the 1inch team discovered a vulnerability in resolver smart contracts using the obsolete Fusion v1 implementation. No end-user funds were at risk—only resolvers using Fusion v1 in their own contracts. We’re actively working with affected resolvers to secure their systems.We urge all resolvers to audit and update their contracts immediately. For more details and bug bounty info (inc. funds return), visit[ HackenProof.]

However, the attack had already resulted in the theft of $5 million, a detail that 1inch had been notified about and appeared to hint at with discussions of "funds return" for example. Security firm Decurity describes observing the transactions and being unable to determine if there was a vulnerability or perhaps it was a simple phishing attack, and notifying 1Inch Exchange at the time. It wasn’t until SlowMist, a security firm, conducted a follow-up investigation that the full scale of the theft—2.4 million USDC and 1,276 WETH—was revealed.

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

A bounty of $450,000 USD was paid for the discovery.

Total Amount Recovered

The total amount returned was 2,400,000 USDC and 1.076 WETH.

The total amount recovered has been estimated at $4,550,000 USD.

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.