Hats.V2 vs Sherlock: Which security option fits? (2026)

The key difference is what each product asks you to use. Hats.V2 is an onchain marketplace for standing bug bounties and audit competitions. Projects can list programs, while users can supply liquidity to help fund bounty payouts. That makes it relevant to projects seeking an open bounty route, as well as researchers and liquidity providers.

Sherlock is a security services provider aimed mainly at Web3 teams. Its offerings include private, staffed audits, open contests, AI-assisted review, and bug bounties. Teams can buy services separately or combine them across development, launch, and live operation. Researchers can also take part in contests and bounties, but Sherlock is not primarily a retail-user product.

In short, Hats.V2 centers on onchain programs and pooled payout funding; Sherlock centers on delivering security work to client teams. Their listed TVL figures do not make them direct substitutes.

Neither publishes a clear fee schedule. Hats.V2 does not set out its fee structure, payout splits, or committee rules in the information described here. If you plan to deposit into a vault or submit a finding, check that specific vault's terms before acting. Network gas fees also apply to transactions on the chosen blockchain.

Sherlock does not publish prices for audits, contests, or bounties. It directs teams to contact its team, with engagements apparently priced case by case. Public reward amounts and terms are not specified, so teams and researchers should confirm them before committing.

For a project trying to budget in advance, neither offers published prices to compare. Sherlock is explicit that teams need to request a quote; Hats.V2 requires attention to the terms of the individual vault. Do not assume that the larger range of services means Sherlock is more expensive, or that an onchain bounty is free to run.

Hats.V2 has no protocol audits listed. Its liquidity model also creates a direct financial risk: providers' deposits back bounty payouts, so a valid vulnerability finding can reduce the pool. Its materials do not describe a licence, insurance, or custody arrangement. Read the terms of each vault and review any published technical documentation before depositing.

Sherlock has two audits listed, but it does not specify whether they cover Sherlock's own contracts or explain their scope. As a service provider, its main risk for clients is the quality and reliability of the work. Published audit reports can help you assess a specific engagement, but an audit or contest cannot guarantee that a protocol is free of bugs.

Sherlock also presents headline performance figures as self-reported, without a public methodology described here. Treat those claims separately from the scope and findings of a particular engagement. Neither option removes the need to assess risks for yourself.

Hats.V2 has the broader chain coverage: Ethereum, Arbitrum, Polygon, BNB Chain, and Optimism. Its permissionless setup is a notable feature for projects that want to list programs and for users who want to supply liquidity. Its reported TVL is about $155,000, which indicates a relatively small pool of funds for attracting researchers and supporting payouts.

Sherlock lists Ethereum and reports about $228,000 in TVL. Its feature set is broader as a service business: private audits, public contests, an AI review tool, and live bug bounties. It also has ranked researchers and published audit reports. Pentesting, managed detection and response, and OPSEC are listed as early-access services, so they should not be treated as equally established offerings.

Neither lists a protocol token. For Hats.V2, liquidity incentives depend on each vault's terms; Sherlock's service and reward terms need to be checked for each engagement.

Choose Hats.V2 if you want a permissionless, onchain bounty marketplace across several EVM networks, or if you are evaluating whether to provide liquidity for bounty payouts. Before depositing, understand that a successful claim can draw down the pool, and verify the vault's terms. The lack of listed protocol audits is an important caution.

Choose Sherlock if you represent a Web3 team looking for a provider that can handle private audits, contests, AI review, or live bounties. Its services span more stages of a project's lifecycle, and two audits are listed, though their scope is not specified. Expect to request pricing and judge each engagement by its scope and published work.

If you are an individual user who is not a researcher or liquidity provider, neither is designed as a general-purpose dApp. Sherlock is the clearer fit for teams buying security services; Hats.V2 is the more direct fit for onchain bounty participation.