Cyfrin flags hidden fields in 1inch clear-signing descriptors
Cyfrin rated several clear-signing defects in 1inch's router V6 descriptors as high severity in late July 2026, including a field identifying the contract that receives user funds. As of October 12, the display rules remained in the public registry and covered 13 networks, including Ethereum. The audit found no attestation for the V6 router descriptors, while clear signing is meant to prevent blind-signing exploits such as the 2025 Bybit hack.
Cyfrin's review of 1inch's V6 router descriptor, tracked as ticket 2688, identified two high-severity and three medium-severity display problems. One high issue involved clipperExchange, a hidden parameter naming the contract that would receive the user's funds; another concerned hidden args data that can carry the recipient address for purchased assets in certain order modes. Medium findings included a sell/buy amount mismatch, a concealed permitAndCall spending approval, and unverified Sourcify deployments.
A related ticket, 2690, covered the zkSync router descriptor, which reused the main file. Maintainers removed it from the registry on September 22 because of verification concerns. The main V6 descriptor still lacked audit attestation in the registry and applied across 13 networks, including Ethereum, as of October 12.
Wallet users interacting with 1inch on affected networks could be most directly affected, since hidden recipient or approval details may make transaction screens less informative than expected. If such gaps persist, they may weaken confidence in clear-signing standards and wallet interfaces that rely on public descriptors. Auditors, wallet developers, and DeFi aggregators may face pressure to improve verification and attestation processes. The broader impact may depend on whether these display rules are corrected or remain in use, and whether users can independently verify transaction details before signing.