# \[1IP-XX\] Aqua Incubator: Reallocate Uncommitted Grant Funds to a Security Audit Pool

**URL:** <https://gov.1inch.network/t/1ip-xx-aqua-incubator-reallocate-uncommitted-grant-funds-to-a-security-audit-pool/1025>\
**Category:** General\
**Created:** [October 27, 2026, 12:56pm UTC](https://gov.1inch.network/t/1ip-xx-aqua-incubator-reallocate-uncommitted-grant-funds-to-a-security-audit-pool/1025 "2026-10-27T12:56:15Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anode](https://sea1.discourse-cdn.com/flex001/user_avatar/gov.1inch.network/anode/32/133_2.png) [@Anode](https://gov.1inch.network/u/Anode)\
**Post date:** [October 27, 2026, 12:56pm UTC](https://gov.1inch.network/t/1ip-xx-aqua-incubator-reallocate-uncommitted-grant-funds-to-a-security-audit-pool/1025/1 "2026-10-27T12:56:15Z")

</div>

# [1IP-XX] Aqua Incubator: Reallocate Uncommitted Grant Funds to a Security Audit Pool

_Amendment to 1IP-93. Draft for forum discussion, prepared by Anode as Programme Steward, 27 October 2026._

## Summary

1IP-93 allocated USD 400,000 in grant funding, sized for up to eight teams at USD 50,000 each. Four teams have been approved. The programme is not going to fund eight, and the reason is quality rather than timing.

This proposal asks the DAO to redirect the USD 200,000 of uncommitted grant funding to a security audit pool for the four approved strategies, capped at USD 50,000 per strategy, paid against invoices directly to the audit firm, with any unused balance remaining in the treasury.

The case is simple. 1IP-93 requires every funded strategy to be integrated into the 1inch dApp at Milestone 4. It did not fund the independent security audit that integration should require. Four strategies are heading toward a user-facing surface with no money allocated to have their code reviewed. Reallocating funds the programme has already decided not to spend is the cheapest available fix.

## Background

| Item | Amount (USD) |
| --- | --- |
| Approved by 1IP-93, total | 436,000 |
| Of which grants, at a maximum of 50,000 per team | 400,000 |
| Of which programme stewardship | 36,000 |
| Committed to date, four approved teams at 50,000 | 200,000 |
| **Uncommitted grant funding** | **200,000** |

The four approved teams are Aqua0, Bleu, Steer Finance and 1delta. Each was approved unanimously by the Grant Reviewer panel, 3 of 3, against the 2 of 3 threshold set by 1IP-93.

New applicant intake was paused on 17 September 2026 so the programme could close out the teams already in the pipeline. In the course of working through that pipeline, several applications were declined and others were placed on hold. The honest position is that the remaining pipeline did not contain four more strategies the panel would have approved. Holding USD 200,000 open against applications that do not exist is not prudence, it is inertia.

## The problem this solves

1IP-93 structures funding across four milestones, the last of which is integration into the 1inch dApp at 50% of the grant. Integration puts these strategies in front of 1inch users and, through Aqua, alongside other makers sharing the same liquidity accounting. None of that is a low-assurance environment.

1IP-93 made no provision for independent security audits. The consequence is now visible across all four grantees.

| Team | Audit position as drafted |
| --- | --- |
| Bleu | Milestone 4 expressly requires an independent security audit passed on the frozen Milestone 3 build with findings resolved. Bleu requested an audit budget separate from and additional to the 50,000 grant, because the grant does not cover it. |
| Aqua0 | Milestone 4 requires a security self-audit with zero critical findings, and requires only that an external audit firm be selected and a quote obtained. The external audit itself is deferred and unfunded. Mainnet deposits and withdrawals are disabled until an audit happens, and dApp integration is read-only until then. |
| Steer Finance | Milestone 4 requires an internal security-validation report. |
| 1delta | An audit is required before full mainnet launch. |

An unfunded audit is therefore not only a safety gap, it is a launch blocker on a strategy the DAO has already paid 50,000 to build. The DAO has bought a strategy it cannot switch on.

## Proposal

1. **Establish an Aqua Incubator Security Audit Pool** of up to USD 200,000, funded entirely from the uncommitted balance of the grant allocation approved under 1IP-93. No new funds are requested from the treasury.
2. **Make available up to USD 50,000 per approved strategy** toward one independent security audit. Eligible strategies are the four approved under 1IP-93: Aqua0, Bleu, Steer Finance and 1delta.
3. **Pay against invoices, not in advance.** Funds are released on presentation of an executed engagement letter and invoice from the audit firm, and are paid directly to the audit firm rather than to the grantee. Grantees do not receive and do not custody audit funds.
4. **Return the unused balance.** Any part of the 200,000 not drawn within the pool period remains in the DAO treasury. Nothing is pre-allocated to a team that does not use it.
5. **Make the audit a Milestone 4 condition.** Where a grant agreement does not already require an independent audit, amend Schedule A so that Milestone 4 cannot be certified without one, with findings at critical and high severity resolved. This is what turns the funding into assurance, and it should not be optional.

## Governance of the pool

| Question | Answer |
| --- | --- |
| Who approves a draw? | The Grant Reviewer panel, by simple majority of at least 2 of 3, on a recommendation from the Programme Steward. The same threshold 1IP-93 sets for every other funding decision. |
| Who selects the auditor? | The grantee proposes, the panel approves. The panel may decline a firm but may not impose one. |
| What qualifies as an audit? | A paid engagement by an independent third-party firm with a published track record in Solidity and DeFi protocol review. Not a self-audit, not a review by a party affiliated with the grantee, not an automated scan alone. |
| Who holds the funds? | The same DAO Ops Multi-Sig that disburses grants under 1IP-93. The 1inch Foundation administers under 1IP-101 and does not custody funds. |
| Does an audit draw count as Revenue or Grant? | No. It is a programme expense paid to a third party. It does not increase the grant, does not change the revenue share, and is not subject to clawback against the grantee, who never receives it. |
| Pool period | Twelve months from the date this proposal passes, extendable once by panel decision with a public note. |
| Reporting | Each draw is disclosed in the next quarterly programme report, naming the strategy, the firm, and the amount. |

## Budget

The ceiling is USD 200,000, which is the exact uncommitted balance. The expected draw is lower.

| Scenario | Basis | Total (USD) |
| --- | --- | --- |
| Ceiling | Four audits at the 50,000 cap | 200,000 |
| Expected | Four audits at a typical 30,000 to 45,000 for codebases of this size | 120,000 to 180,000 |
| Floor | Two teams draw, two do not | 60,000 to 100,000 |

Because the pool reimburses rather than allocates, the DAO pays the actual number rather than the ceiling. The difference stays in the treasury. Asking for a 200,000 ceiling and expecting to spend 150,000 is the honest framing, and the quarterly reports will show which it was.

## Why this rather than funding four more teams

The alternative use of the 200,000 is what 1IP-93 originally contemplated: four more grants. Three reasons not to.

- **The pipeline does not support it.** Intake is paused. The applications reviewed between July and September did not produce four more strategies the panel would approve, and several were declined on scope or execution grounds. Deploying capital to hit a number rather than to back a strategy is how grant programmes lose credibility.
- **Marginal value is lower.** A fifth strategy of uncertain quality is worth less to the DAO than four audited strategies that can actually be switched on. Aqua0 is a concrete case: the DAO has already spent 50,000 and cannot turn the product on.
- **Concentration of risk.** Every funded strategy settles through Aqua and shares the same liquidity accounting. The cost of a failure in one is not confined to that one. Spending on assurance across the existing set is better risk-adjusted than spending on breadth.

If the panel later identifies strategies worth funding and the pool is undrawn, a further proposal can redirect what remains. This proposal does not close that door; it just stops holding capital against a queue that is empty.

## Implementation

1. On passage, the Programme Steward writes the audit condition into Schedule A of each grant agreement by written variation, for the agreements not yet executed, and by amendment for any already executed.
2. Grantees are notified of the pool, the cap and the process within five working days.
3. The Steward publishes a one-page process note covering auditor eligibility, the engagement letter requirements and the draw request format.
4. Draws are recorded in the programme records and disclosed in each quarterly report.

## Vote

**For:** Establish the Aqua Incubator Security Audit Pool of up to USD 200,000 from the uncommitted 1IP-93 grant allocation, on the terms above, and make an independent security audit a condition of Milestone 4 for all four approved strategies.

**Against:** Retain the uncommitted USD 200,000 within the existing grant allocation for further strategy grants under 1IP-93 as originally approved.

**Abstain**