Sherlock
Web3 security platform running audit contests, private collaborative audits and bug bounties.
No project pays to be listed. How we rank
Sherlock key facts
| Category | Security and compliance |
|---|---|
| Platforms | Web |
| Launched | 2021 |
| Company | Audit contests, collaborative audits and bug bounties |
| Pricing | Quoted per scope; 25% deposit reserves an audit slot |
| US availability | Available: terms restrict only sanctioned jurisdictions |
What is Sherlock?
Sherlock is a Web3 security platform founded in 2021. It runs open audit contests where researchers compete to find bugs, private collaborative audits, an AI-based Audit Engine and post-launch bug bounties. Its about page states 1,500+ security reviews and 11,000+ security researchers.
How Sherlock works
A Sherlock audit contest is a time-boxed public review.
After scoping, the protocol fixes a final commit or branch, and vetted researchers, called Watsons, review it in parallel and submit issues. Judges validate submissions live, merge duplicates and calibrate severity, so the team gets a curated list of confirmed findings. The team then marks which findings it will fix, ships the fixes as PRs, and Sherlock verifies them before issuing the final report.
Contest length follows code size, measured in Solidity nSLOC with Solidity Metrics: about 3 days for 500 lines, 12 days for 2,000 and 38 days for 6,000. Rust and mixed codebases are scoped by attack surface instead. Collaborative audits use a smaller assembled team, and post-launch bug bounties cover live code. Sherlock AI scans repositories during development.
How to start with Sherlock
- Teams submit an intake request, get a quote based on scope complexity and review window, and reserve a slot with a 25% deposit and a proposed start date.
- If Sherlock cannot meet that date, the protocol can withdraw the deposit in full.
- Narrow scopes and update reviews can often start within a few days.
- Before the start you hand over the final commit plus deployment context, docs, testing guidance and known assumptions, and the contest is judged against that baseline.
- Someone on your team needs to answer researcher questions in the shared channel during the window.
- Very large scopes may be split into several reviews.
Sherlock fees and limits
- Each audit is quoted per scope, and a 25% deposit reserves the slot.
- Coverage ranges from $500,000 for a codebase scoring 0 points down to $1,000, with each Medium finding worth 1 point and each High worth 5, multiplied by audit type.
Sherlock does not publish a price list. Sherlock Shield, the exploit payout coverage, is not included with every audit: code must pass the audit and fix review and then qualify.
Risks to know before using Sherlock
- Sherlock's disclaimers say it cannot guarantee code is free of bugs and that it is not an insurance company.
- Shield payouts are not guaranteed and run through the Sherlock protocol's onchain claims process on Ethereum mainnet, so funds may not be available when an exploit happens.
- Results apply only to the reviewed scope and version, and later upgrades, integrations or configuration changes are outside it.
- Sherlock V1 and V2 coverage products carry a deprecation notice in the docs.
Sherlock alternatives
Other projects people compare with Sherlock.
Blockchain security firm that audits smart contracts, protocols and infrastructure and builds the Lighthouse client.
Security research firm that audits blockchains, smart contracts, cryptography and AI systems.
Prague audit firm for Solana and EVM smart contracts, maker of the Wake and Trident testing tools.
Security platform with AI agents, researcher bug bounties and Spearbit onchain audits.
Web3 security company offering smart contract audits, formal verification, on-chain monitoring and the Skynet rating.
Blockchain analytics company selling investigation, compliance and monitoring tools to agencies and businesses.
Where Sherlock ranks on DappAtlas
Listed next to Sherlock
- OpenZeppelin Smart contract tool
- Halborn Security and compliance
Sherlock pros and cons
- Contests put hundreds of researchers on one codebase
- Covers audits and post-launch bug bounties in one place
- 1,500+ reviews completed, per its about page
- No published pricing
- Contest results depend on which researchers take part
Sherlock FAQ
What is Sherlock?
Sherlock is a Web3 security platform founded in 2021. It runs open audit contests where researchers compete to find bugs, private collaborative audits, an AI-based Audit Engine and post-launch bug bounties. Its about page states 1,500+ security reviews and 11,000+ security researchers.
How much does Sherlock cost?
Quoted per scope; 25% deposit reserves an audit slot, according to Sherlock’s own page (checked Sep 26, 2026).
Is Sherlock available in the US?
Available: terms restrict only sanctioned jurisdictions, according to Sherlock’s own page (checked Sep 26, 2026).
Sources
How this page works
Sources: Sherlock: official site, Sherlock: About, Sherlock: Homepage. Data as of Sep 26, 2026.
Not affiliated with any project listed. Educational content, not financial advice.