Diligence Requirements

Whitehats must: 1) Notification. Contact 1inch Security (contact details listed below in the Contact Details section) immediately upon initiating any rescue action; 2) Disclosure. Provide a full written disclosure of the vulnerability, rescue methodology, and all addresses used within 24 hours of initiating the rescue; 3) Confidentiality. Execute and adhere to a non-disclosure agreement covering all vulnerability details until 1inch confirms the vulnerability has been fully patched and publicly disclosed; 4) Sanctions. The Whitehat is not, and is not owned or controlled by or acting on behalf of any person that is the subject of sanctions administered or enforced by OFAC, the UK, the EU, or the UN, and will cooperate with comprehensive sanctions and AML screening by 1inch prior to disbursement; 5) Forensic cooperation. For any rescue involving gross exploited value exceeding USD 250,000, provide reasonable cooperation with a forensic investigation conducted by an independent incident-response firm engaged by 1inch, in each case solely for the purpose of verifying Whitehat's eligibility under Section 2.3(b) of the Agreement. Not applicable to: 1) Blackhats and accomplices. Any person who directly or indirectly caused, initiated, assisted, funded, or coordinated the exploit, or is acting in concert with or under common control with such a person. Returning funds does not convert such a person into an Eligible Whitehat. 2) Former insiders (12-month look-back). Any person who is, or within the twelve (12) months preceding the rescue was, an employee, contractor, officer, director, or service provider of an entity adjacent to the 1inch ecosystem or any of their affiliates (or an immediate family member of such a person). Where 1inch has reasonable doubt as to a Whitehat's compliance with any of the above, 1inch may require the Whitehat to provide additional information, including documentation sufficient to verify their identity, jurisdiction, and beneficial ownership, as a precondition to bounty disbursement. Failure to provide such information within a reasonable period renders the Whitehat ineligible.