1inch Descriptors Hide Transaction Data Across 13 Deployments

Clear-signing descriptors for 1inch’s AggregationRouterV6 can hide transaction details that affect fund recipients, order restrictions and how compatible wallets interpret swaps across multiple networks. Issues opened July 22, 2026, identify five findings in the calldata descriptor: four display problems and one source-verification issue. The two highest-severity findings involve hidden clipperExchange and args fields. The descriptor marks clipperExchange as visible: "never" in both clipperSwap and clipperSwapTo. That field can identify a caller-supplied contract receiving a user’s input tokens, meaning a wallet may show an ordinary swap summary without displaying the contract handling those tokens.

Source: TokenPost