At the end of July 2026, the audit firm Cyfrin classified several defects in 1inch’s clear signing at the “high” severity level. Thus, certain fields, including the contract which receives the funds committed by the user, do not appear on the wallet screen. As of October 12, these posting rules still appear in the public register. They cover the 1inch V6 router on 13 networks, including Ethereum.
In brief
- 13 networks: this is the number of blockchains, including Ethereum, on which the audited descriptor of the 1inch V6 router applies.
- 2 “high” defects: Cyfrin noted them in this descriptor, including a field which designates the contract receiving your funds.
- No Attestation: The V6 router descriptors have not received any audit validation in the registry.
- May 12, 2026: on this day, Ledger entrusted the clear signing to the Ethereum Foundation.
Clear signing, a response to the Bybit hack
In February 2025, the record Bybit hack cost the platform approximately $1.5 billion, according to the FBI. The FBI also attributes this theft to North Korea. According to CertiK analysisthe Safe{Wallet} interface displayed a legitimate transaction. However, the data sent to the Ledger for signature was different. The CEO of Bybit also said he did not check them on the device screen. CertiK speaks here of blind signing.
Clear signing addresses this problem. It translates the data of a transaction into clear language, on the screen of your crypto wallet. Ledger launched it in 2023 then formalized it in the ERC-7730 standard proposal. Then, on May 12, 2026, the company entrusted management to the Ethereum Foundation. MetaMask, Trezor, WalletConnect and Cyfrin participate in the working group.
The system is based on public files, called descriptors. Each one tells the wallet which fields of a transaction to display, and under what label. A field marked “never” therefore never appears on the screen.
The contract that receives your funds may remain invisible
1inch is a decentralized exchange aggregator. Cyfrin has audited several of its descriptors. THE ticket no. 2688 targets the main descriptor of the V6 router. It has two findings of high severity and three of medium severity, according to the auditor’s classification.
The first observation concerns the clipperExchange parameter, hidden on the screen. However, it designates the contract which receives the funds from the user. It is the caller of the function that provides this parameter. According to Cyfrin, the wallet therefore displays a normal exchange screen, without showing the contract which receives the funds.
The second high observation targets the args field, also hidden. In some order execution modes, it may contain the address that receives the purchased asset. The user can then see exact amounts, while the asset goes to an address that he or she does not see, according to the auditor.
Two average observations also concern the display. First, the amount of an order always appears as a “to sell” amount. However, a router mode treats it as an amount to purchase. Next, the permitAndCall function hides a spending authorization which can specify the token, the address authorized to spend, the amount and the due date. Finally, the last average finding concerns deployments that Sourcify had not yet verified.
1inch’s clear signing unchanged on 13 networks
A neighboring ticket, the No. 2690was targeting the zkSync version of the router. This nine-line descriptor referred to the same common file as the main version. The maintainers have it removed from the register on September 22. The reason is indeed due to verification. Sourcify, the code checking tool used by the registry, does not yet know how to check the code compiled for zkSync. This removal therefore does not correct the display rules.
However, the main branch of the register, consulted on October 12, still contains these rules. The current Common File and Master Descriptor date from April 10, 2026. They apply to the V6 Router on 13 networks, including Ethereum, Arbitrum, Base, BNB Chain, and Polygon. The descriptor of the previous version, V5, also hides clipperExchange on six networks.
A third audit, the #2689concerns orders signed off-chain, in EIP-712 format. The descriptor there hides the makerTraits field. It may contain the expiration date of the order and a restriction on the address authorized to execute it. Cyfrin also classifies this finding as high severity.
A certificate does not guarantee the meaning displayed
The register provides a safeguard, the certificate. The standard project ERC-8176 defines this mechanism. It allows an auditor to sign off on a descriptor that they have reviewed. On August 17, the registry integrated Cyfrin attestations for 181 descriptors.
In the 1inch folder, only the older versions V3 and V4 of the router carry one. On the other hand, V6 descriptors do not have them. In audit no. 2689, Cyfrin notes the absence of code verification on five networks: “the certification condition is not met” (editor’s translation). ERC-8176 then leaves each wallet to choose which listeners it trusts.
However, even when attested, a descriptor can be misleading. The ERC-8176 project writes this in its section devoted to the limits of the device.
Signature verification does not validate semantic correctness.
ERC-8176, Descriptor Attestations for ERC-7730, draft standard
Another limitation is scalable contracts, or proxies. A proxy keeps its address, but its code can change. A analysis published in September identified 80 descriptors linked to proxies out of 382, as of September 5. The maintainers then chose to keep them and address the problem in the standard itself.
What clear signing displays, and what it omits
The registry also fixes defects. On September 25, a patch has targeted another descriptor of 1inch, for limit orders in its Limit Order Protocol v2. According to his message, wallets that recognize descriptors by signed type could not apply it. Users therefore signed these orders “blindly”.
For the user, a readable screen only displays the fields retained by the descriptor. Thus, the absence of a recipient or an expiration date is not visible. Cyfrin recommends displaying these fields or removing the description. In this second case, the wallet reverts to a raw signature, without giving the impression of clarity. None of the tickets consulted report user loss linked to these descriptors. Our guide to the most secure crypto wallet details the other protections available.
As of October 12, the two audited V6 descriptors still present in the register remain unchanged. The third, for zkSync, left the registry without correction. For the makerTraits field, the correction proposed by Cyfrin modifies a single line of the file, to make the field visible. [À COMPLÉTER : réponse datée de 1inch, de Cyfrin ou des mainteneurs du registre, ou mention des sollicitations restées sans réponse] On the proxy side, the proposition no. 1738 is not yet integrated into the standard. Kaan Uzdoğan, co-author of ERC-7730, indicated on GitHub that he was waiting for further reviews before approving it.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
