1inch Hack

On 5 March 2025 an attacker drained about $5 million (roughly 2.4 million USDC and 1,276 WETH) from the resolver contract of market maker TrustedVolumes by exploiting a calldata corruption bug in 1inch's obsolete Fusion V1 Settlement contract. 1inch said no end users were affected. The loss hit resolver contracts that still trusted calls coming from the V1 settlement contract.

The bug was in the hand-written Yul of _settleOrder. That function appends a suffix, which includes the resolver address, to each order's interaction data at an offset computed as ptr + interactionOffset + interactionLength. Because interactionLength was a full 32-byte word supplied by the caller, the attacker set it to -512 (0xff...fe00). The pointer wrapped around, the real suffix landed in padding, and a fake suffix naming the attacker's contract as resolver was used instead. The Settlement contract then called back as though that contract were the resolver, and TrustedVolumes' resolver, which only checked that the caller was the Settlement contract, paid out full order amounts in exchange for a few wei.

TrustedVolumes negotiated with the attacker on-chain. By about 04:12 UTC on 6 March the attacker had returned the funds, keeping roughly $450,000 as a bounty. 1inch redeployed the relevant contract and urged resolvers to move to Fusion V2. Decurity, one of nine firms that audited Fusion V1, said the vulnerable code was introduced in a November 2022 rewrite to Yul, after its October 2022 audit, and was replaced again in March 2023 before a scheduled re-audit, so no audit reviewed the version that was exploited.

Exploit transaction example: 0xb5c94efa0c8fd8f5c8cc2826e374a99620b01061d395b59b8f45dddc9fce1c60