Dormant Yul Bug Lets Attacker Drain $5M From 1inch Fusion Resolvers

A calldata-corruption flaw buried in 1inch's retired Fusion v1 resolver contracts allowed an attacker to extract roughly $5 million from several market makers (resolvers) using nothing more than a manipulated integer. The vulnerable code lived in the _settleOrder function — a leftover piece of an earlier architecture that was never supposed to still be reachable. Nine separate audit teams had reviewed related code over roughly two years without flagging the issue, according to credited analysis from 1inch, SlowMist, Decurity, and researcher shoucccc.

Disclosure and discovery of the shortfall

On March 6, 1inch disclosed that it had found a vulnerability in its deprecated Fusion v1 resolver contracts, stating that no end-user funds were at risk. That initial statement did not mention that approximately $5 million had already been drained from resolvers' own funds. The scale of the loss only became clear the following day, when SlowMist ran its own investigation and reported that 2.4 million USDC and 1,276 WETH were missing.

Attacker infrastructure

The attacker's wallet was initially funded via Tornado Cash. Relevant addresses:

• Exploit deployer: 0xa7264a43a57ca17012148c46adbc15a5f951766e
• Attack contract: 0x019bfc71d43c3492926d4a9a6c781f36706970c9
• Funds receiver: 0xbbb587e59251d219a7a05ce989ec1969c01522c0
• Victim (resolver) — TrustedVolumes: 0xb02f39e382c90160eb816de5e0e428ac771d77b5
• 1inch Settlement V1 contract: 0xa88800cd213da5ae406ce248380802bd53b47647

How the exploit worked

The attack unfolded across a series of crafted transactions: 0x04975648e0db631b0620759ca934861830472678dae82b4bed493f1e1e3ed03a, 0xb5c94efa0c8fd8f5c8cc2826e374a99620b01061d395b59b8f45dddc9fce1c60, 0xb16bbf03d324b66685c94d62dbe31c739ee23c114b3915d169c74cd7c98eec8c, 0x3947e5a4d98104e313e08ee321673e1183db3d6ff8b7207f3eabb36f71436c1d, 0x9ce5187c7160f531189e4765f21af5975dc2a62d961fb61ae09866d082918256, 0xb0688eb1f46c28f36d7397366146fced23d3f8da7e08b760a5f612ce134ee9d2, and 0x62734ce80311e64630a009dd101a967ea0a9c012fabbfce8eac90f0f4ca090d6.

Each followed the same pattern: construct an order that superficially swapped a trivial amount for a large payout, pad the calldata with null bytes, set the interactionLength parameter to -512 — represented as 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe00 — and append a fabricated suffix structure disguised as an interaction. That negative length value caused memory pointers to underflow, redirecting execution and routing control toward TrustedVolumes' resolver contract. The resolveOrders function selector (0x1944799f) served as the entry point used repeatedly against resolver after resolver.

The attack reached its final phase through a rapid sequence of three more transactions — 0xc69b4c8029c70ae468e92af31120ac6b01bb89c6e35d34818413e9942aedebb6, 0xefcb740bf9ec17ed99839ffcc05393fae5ec2d44149aee91ba119f48bc20a1ef, and 0x74bc4d5dc7f8da468788da6087bb9f73465966ab5b8cf9cf1053d98e78a9bf96 — with the last of the theft completed by 5:54 PM UTC. In short, the entire scheme hinged on a single value: the number 512, expressed in hex as 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe00, used to corrupt calldata and hijack the resolver address that subsequent logic would act on.

Negotiation and partial recovery

Not long after the theft, the attacker sent an on-chain message asking, in effect, for a bounty. TrustedVolumes responded via on-chain messaging to open negotiations. Roughly five hours later, at 11:55 PM UTC, talks concluded, and by midnight the attacker began returning funds, keeping a cut framed as a "white hat fee." By 4:12 AM on March 6, most of the funds had been sent back, with the attacker retaining approximately $450,000 — around 10% of the recovered amount — as a self-assigned finder's fee.

Two return transactions were recorded: $2.4M in USDC and 1,076 ETH, worth roughly $2.09M at the time.

During the return process, the attacker mistakenly sent roughly half of the stolen funds to 1inch's own settlement contract rather than to a wallet they controlled, exposing that portion to anyone able to claim it. This set off a scramble among outside parties, including researcher shoucccc, to grab the exposed funds before the attacker could reclaim them. As shoucccc described it: "the hacker incorrectly transferred half of the stolen funds to the 1inch settlement contract, making the funds available for everyone to grab, and he spent quite sometime to get funds back. We were trying to compete but the hacker got it first unfortunately."

Root cause: a two-year-old Yul refactor

Two days after the exploit, security firm Decurity, through researcher Omar Ganiev, published a detailed postmortem. Ganiev's analysis concluded that despite the involvement of nine separate audit engagements, the underlying flaw amounted to a basic buffer-overflow condition that had gone unnoticed for years.

The bug's origin traced back to November 2022, when 1inch rewrote the relevant contract logic from Solidity into Yul. Decurity's writeup also disclosed its own part in the story: an initial audit round in October 2022 covered the pre-Yul codebase; the migration to Yul happened in November; by December, multiple firms were reviewing the refactored contracts, but the _settleOrder function fell outside the scope of those reviews. In March 2023, Decurity did identify the integer-overflow risk in question — but within 24 hours a new contract implementation was deployed, and the earlier vulnerable version that had already been released into production was overlooked in the shuffle. The flaw then sat live and unexploited in production code for more than two years before this incident.

Aftermath

TrustedVolumes ultimately recovered most of its funds, losing about $450,000 (roughly 10%) as the price of getting the rest back. The 1inch protocol itself was not directly drained of user funds, though the episode raised questions about oversight of legacy code left active for years after audits had signed off on it. 1inch subsequently launched a bug bounty program and urged resolvers to audit and update their contracts immediately. Decurity, for its part, acknowledged that it had identified the integer-overflow risk back in March 2023 but had lost track of the issue once the code was refactored shortly afterward.