1inchOpenZeppelin and Decurity audit Aqua router and SwapVM
Security firms OpenZeppelin and Decurity have published audits of 1inch's Aqua router and SwapVM stack. OpenZeppelin audited the SwapVM execution engine, the Aqua router, and the live pegged-swap and concentrated-liquidity instructions; Decurity audited the concentrated-liquidity delta math and the calldata bounds on VM hook paths.
- In the audited flow, Aqua prices a fill onchain, the provider signs the instructions, and SwapVM runs them at execution
- Both reports are public; each counts as one of eight independent Aqua and SwapVM audits
- 1inch noted "an audit is not a guarantee" alongside the disclosure, following similar public reports from Hexens and Nethermind as it continues publishing audit work across its swap stack
Sources
- @DecurityHQ All public 👇 https://t.co/WzaCXxalZS Replying to their earlier post: Concentrated liquidity depends on exact delta math. @DecurityHQ audited those calculations and the calldata bounds on VM hook paths. One of 8 independent Aqua and SwapVM audits. https://t.co/RkwV7rms8…x.com ↗
- Concentrated liquidity depends on exact delta math. @DecurityHQ audited those calculations and the calldata bounds on VM hook paths. One of 8 independent Aqua and SwapVM audits. https://t.co/RkwV7rms8ex.com ↗
- Aqua prices a fill onchain. The provider signs the instructions. SwapVM runs them at execution. @OpenZeppelin audited that engine, the Aqua router, and the pegged-swap and concentrated-liquidity instructions that are live. https://t.co/5pgF6RsxVkx.com ↗
- An audit is not a guarantee. Report is public. One of eight Aqua and SwapVM audits: https://t.co/WzaCXx9Oak Replying to their earlier post: Aqua prices a fill onchain. The provider signs the instructions. SwapVM runs them at execution. @OpenZeppelin audited that engine, the Aqua router, and the pegged-swap and concentrated-liquidity inst…x.com ↗
1inch
