Sherlock

Sherlock is a Web3 security company that runs public and private audit contests, staffed "collaborative" audits, bug bounties and AI-assisted review. It also offers optional exploit-payout coverage ("Sherlock Shield") for qualifying audited code. It fits EVM teams, and increasingly Rust, Solana and L1 teams, who want many independent reviewers on a frozen scope, or a staffed team with fix verification. The strongest evidence-backed signal is its public contest record: 301 finished contests were listed by the platform's contest API on 2026-09-24, including 2025–2026 programs for the Ethereum Foundation (Fusaka), Aave V4 and the XRP Ledger.

At a glance

Founded	Not stated on the firm's pages; the earliest engagement in its report archive is November 2021
Headquarters / jurisdiction	Not published; the site footer names "Sherlock Protocol" (contact)
Engagement model	Competitive contest platform plus staffed collaborative audits, bug bounties and an AI "Audit Engine" (homepage, docs)
Core specialties	DeFi smart-contract review (lending, stablecoins, perps, vaults), protocol upgrades, post-audit coverage
Ecosystems / languages	EVM (Solidity) predominantly; also Solana, Sui, XRPL, Rust-based L1s and zkVMs, based on contest listings
Public report index	sherlock-protocol/sherlock-reports (archive to Sept 2025); contest results at audits.sherlock.xyz/contests
Open-source tooling	None found as maintained tools; Sherlock AI is a hosted product (docs index)
Published pricing	Not published as prices; contest length by codebase size and Shield coverage tiers are published (timeline, Shield)

What they do

The homepage and docs describe these products:

• Audit contests: Many vetted independent researchers ("Watsons") review the same scope. Judging runs live during the contest, followed by remediation and fix verification.
• Collaborative audits: Staffed private engagements. Per the collaborative audit docs, a team is assembled for each engagement. The process runs from scoping, quote and readiness check (code frozen three days before the start), through audit, remediation and fix review, to a final report published after fix verification.
• Bug bounties: Pre-launch and post-launch programs with in-house triage.
• Sherlock AI, Blackthorn and Audit Engine: An AI repository-analysis tool, a premium collaborative tier and an AI-plus-researcher orchestration layer. A post dated 19 August 2026 on the blog explains the rationale for Audit Engine.
• Sherlock Shield: Optional exploit-payout coverage. It is available only for qualified code that has completed a Sherlock audit and fix review; it is not included by default.

The Shield docs publish the coverage formula. Each Medium finding scores 1 point and each High scores 5, with multipliers by audit type. Coverage ranges from $500,000 at 0 points down to $1,000 at 30 or more points. Sherlock "does not guarantee payment or the availability of funds". The older GitHub archive README still advertises repayment of "up to $2M". Treat the current docs as authoritative and confirm the terms in writing.

The homepage claims 11,000+ registered researchers, 1,500+ audits and security reviews, 2,000+ critical vulnerabilities found and $250B+ TVL secured (homepage). These figures are self-reported and were not independently verified.

Specialties and ecosystem coverage

• EVM / Solidity: Strongly evidenced. The published contest sizing guidance is based on Solidity nSLOC (timeline docs). The archive shows long-running work for Notional, Perennial, Index Coop, LooksRare, Optimism (Bedrock, March 2023; Fault Proofs, April 2024) and Euler (2021 and 2022) (README). These confirm every "notable audit" listed in the directory.
• Beyond EVM: Recent contest listings include Solana (Privacy Cash, Raindrops), Sui (Current Finance), the XRP Ledger, a Rust-VM L1 (Dango DEX) and a zkVM (Brevis Pico). The directory's chain list (Ethereum, Polygon, Arbitrum, Optimism, Base) understates this range.
• Insurance / coverage: Confirmed as Sherlock Shield. It is now an opt-in product with published tiers.

Recent public work

Pulled from the contest API on 2026-09-24 (API); each links to its contest page. Several recent programs are bounty-style contests rather than classic audit contests.

1. Metric DEX, July 2026, public bug-bounty contest (contest 1279)
2. XRP Ledger, April 2026, public bug-bounty contest (contest 1260); the case studies page reports 2 critical vulnerabilities and $309,000 in rewards for Ripple's XRPL testing
3. Fluid DEX v2, January–February 2026 (contest 1225)
4. Flying Tulip, January 2026, public contest (contest 1223)
5. Aave V4, December 2025 to January 2026 (contest 1209)
6. Centrifuge Protocol V3.1, October–November 2025 (contest 1028)
7. Ethereum Fusaka upgrade (Ethereum Foundation), September–October 2025, prize pool of about $2M per the API (contest 1140)
8. Tangent (USG), September 2025, report in the GitHub archive

The case studies page also lists Babylon, Morpho (Vaults V2), Sky and Aave, without dates.

Count note: the API returned 301 finished contests on 2026-09-24. By start year that was 28 in 2022, 80 in 2023, 123 in 2024, 58 in 2025 and 12 in 2026 (through July). The count includes public, private, "best efforts" and bug-bounty contest types. Private collaborative audits outside the contest platform are not included, and the drop in 2026 public listings may reflect a shift toward that model. The GitHub archive lists 234 engagement rows, counted on 2026-09-24, with the latest dated September 2025.

Research, tooling and methodology

• Judging and severity: Validity criteria, lead-judge authority and escalation rules are documented in the judging section of the docs index.
• Reviewer attribution: The archive README names the "Lead Senior Watson" for each engagement, so buyers can see which researchers led past reviews (README).
• Sizing: Contest duration scales with Solidity nSLOC, measured with Solidity Metrics (about 3 days for ~500 nSLOC, about 32 days for ~5,000). Non-Solidity scopes are sized by structure and attack surface (timeline docs).
• Content: The blog publishes periodic security reports (Q1 2026) and guides on Rust auditing and cross-chain security.
• Open-source tooling: No maintained open-source analysis tools were identified in this pass.

Track record and incidents

• Euler Finance (14 March 2023, about $197M): rekt.news reports that Sherlock "has taken responsibility for missing the vulnerability in their review of EIP-14" and agreed to pay a $4.5M claim to Euler under its coverage. The exploited donateToReserves function was part of the eIP-14 change that Sherlock reviewed. The loss was far larger than the coverage.
• Cork Protocol (28 May 2025, about $12M): rekt.news quotes Sherlock: "The exploit involves the CorkHook contract which we didn't audit." It reports the vulnerable hook as outside the defined scope of Sherlock, Runtime Verification and Quantstamp. Sherlock's November 2024 Cork report is in its archive.

An exploit after an audit is not by itself proof of a missed finding. In the Euler case, the firm itself acknowledged the miss and paid under its coverage.

Who should consider them, and who might look elsewhere

• Good fit: EVM DeFi teams with a well-tested, frozen scope who want many independent reviewers and public, attributable results. Teams that value a financial backstop and can meet the Shield eligibility rules. Large programs such as L1 upgrades or major protocol versions that suit a bounty-style contest with a large prize pool.
• Might look elsewhere: Teams that cannot freeze code or meet the readiness bar; the docs require code frozen three days before the start and, for collaborative audits, target over 80% test coverage. Teams that need guaranteed confidentiality about the existence of a review (private options exist, so confirm terms). Teams that want formal verification as a core deliverable, which is not a documented Sherlock offering.
• Scope advice: Cork shows that hooks and integrations left out of scope remain unreviewed. List every value-bearing contract when scoping.

How to engage

Use the contact page and choose the service you want (Collaborative Audit, Audit Engine, Sherlock Shield, Audit Contest, Bug Bounty or Sherlock AI). The page states you will hear back within 24 hours. Before you contact them, have ready:

• the frozen commit
• the nSLOC count (Solidity Metrics)
• auditor-facing documentation
• build and test instructions, with coverage reports
• prior audits
• a target launch date

The scheduling and deposit rules are in the docs.

Gaps and unverified claims

• The founding year is not stated on the pages reviewed. The directory's 2021 is consistent with the earliest archived engagement (November 2021) but is not confirmed.
• The GitHub report archive linked in the directory has not listed an engagement since September 2025. Current results live on the contest platform.
• The directory's team size is "11,000+ registered researchers", matching the homepage. That count is the homepage's figure and was not independently verified.
• Collaborative-audit and contest prices are not published.
• Coverage figures differ between the legacy README (up to $2M) and current Shield docs (up to $500,000).
• Headquarters and legal jurisdiction are not published.

Sources

1. Sherlock homepage, accessed 2026-09-24
2. sherlock-reports GitHub repository, accessed 2026-09-24
3. sherlock-reports README (raw, used for row count), accessed 2026-09-24
4. Sherlock contest API (used for contest count and recent list), accessed 2026-09-24
5. Sherlock contests page, accessed 2026-09-24
6. Sherlock docs, accessed 2026-09-24
7. Sherlock docs index (llms.txt), accessed 2026-09-24
8. Audit Contest Timeline docs, accessed 2026-09-24
9. Sherlock Shield docs, accessed 2026-09-24
10. How Collaborative Audits Work docs, accessed 2026-09-24
11. Sherlock contact page, accessed 2026-09-24
12. Sherlock blog, accessed 2026-09-24
13. Sherlock case studies, accessed 2026-09-24
14. Contest 1279: Metric, accessed 2026-09-24
15. Contest 1260: XRP Ledger April 2026, accessed 2026-09-24
16. Contest 1225: Fluid DEX v2, accessed 2026-09-24
17. Contest 1223: Flying Tulip, accessed 2026-09-24
18. Contest 1209: Aave V4, accessed 2026-09-24
19. Contest 1028: Centrifuge Protocol V3.1, accessed 2026-09-24
20. Contest 1140: Ethereum Fusaka Upgrade, accessed 2026-09-24
21. rekt.news: Euler Finance, accessed 2026-09-24
22. rekt.news: Cork Protocol, accessed 2026-09-24