1inch Descriptors Hide Transaction Data Across 13 Deployments

Clear-signing descriptors for 1inch’s AggregationRouterV6 can hide transaction details that affect fund recipients, order restrictions and how compatible wallets interpret swaps across multiple networks.

Issues opened July 22, 2026, identify five findings in the calldata descriptor: four display problems and one source-verification issue. The two highest-severity findings involve hidden clipperExchange and args fields.

The descriptor marks clipperExchange as visible: "never" in both clipperSwap and clipperSwapTo. That field can identify a caller-supplied contract receiving a user’s input tokens, meaning a wallet may show an ordinary swap summary without displaying the contract handling those tokens.

Hidden args data can also contain a 20-byte target address when the relevant takerTraits flag is enabled. In that case, purchased assets can be routed to the embedded address instead of the default caller address, while the signing screen continues to show the token amounts.

The AggregationRouterV6 calldata descriptor covers 13 deployments, with the named networks including Ethereum, Optimism, BNB Chain, Polygon, Sonic, Fantom, Kaia, Base, Arbitrum, Avalanche, Linea and Aurora.

Other calldata findings received medium-severity ratings. The amount field can represent either the taker-asset amount or the maker-asset amount, while the hidden permit field can contain token, spender, amount and deadline information.

A separate EIP-712 descriptor issue rates the hidden makerTraits field high severity. The field can contain an expiration timestamp, an allowed-sender restriction, a WETH unwrap flag and an extension flag, all of which can affect an order’s conditions.

That EIP-712 issue lists 12 deployments that were not verified on Sourcify at the time of review, including Fantom, zkSync, Klaytn, Avalanche and Aurora. The required attestation condition therefore was not met for those deployments.

A separate zkSync descriptor issue identifies two high-severity findings involving hidden args data and the display of amount. When the maker-amount flag is enabled, the field can appear to show the wrong asset and transaction direction.

ERC-7730 descriptors tell compatible wallets how to decode and display transaction calldata and signed messages. The findings concern that display layer rather than a reported defect in 1inch’s underlying swap or order-settlement logic.

No active exploit or losses connected to the descriptors have been confirmed, and it remains unclear whether 1inch has implemented the recommended fixes.