TrustedVolumes: anyone could register as a trusted RFQ signer

What happened

• Root cause per Verichains: registerAllowedOrderSigner had no access control; the signer check used order.receiver while the token pull used order.inventory; replay protection read and wrote different storage keys; the vault granted unlimited approvals to the proxy.
• Attribution: Blockaid linked the exploiter to the March 2025 1inch Fusion v1 incident (via Decrypt). 1inch says its protocols were not involved; TrustedVolumes is one of its resolvers.
• Response: no recovery reported.

Sources

• https://blog.verichains.io/p/trustedvolumes-exploit-analysis
• https://decrypt.co/367070/defi-platform-trustedvolumes-hit-by-6-7m-exploit

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.