Security· ★★★· bearish·

Cyfrin flags hidden fields in 1inch clear signing: fund-receiving contract invisible on screen

  • —Cyfrin rated two high-severity flaws in the 1inch V6 router descriptor dated April 10, 2026
  • —The clipperExchange field is hidden on screen despite designating the contract that receives user funds
  • —V6 descriptors cover 13 networks including Ethereum, Arbitrum, Base, BNB Chain and Polygon, with no attestation
  • —Cyfrin attestations exist only for the older V3 and V4 router versions
Why it matters: Hiding the fund-receiving contract in clear signing revives the blind-signing risk behind Bybit's roughly $1.5 billion loss in 2025.
Source: Cointribune
More on this
DeFi · Oct 1
New BIP461 draft standardizes ECDSA signing to expose hidden key leaks
 Security · Oct 10
OneKey to drop on-screen seed phrase display and encrypt internal wallet communications
 Security · Oct 10
OneKey founder: hardware wallet security hinges on the 'last centimeter' between chip and screen