Security · Review
ActiveSherlock Review 2026: Audits, Contests and Bug Bounties
Sherlock started as a DeFi coverage protocol and now presents itself as a Web3 security company selling audits, contests, AI review and bug bounties. It looks established in the audit market, but pricing is opaque and the claims are self-reported.
By the DappsAtlas editorial team · Updated
DappsAtlas score
7.4/10
Good
Our verdict on Sherlock
7.4/10Sherlock suits protocol teams, institutions and infrastructure builders that want audits, contests, AI review or bug bounties from one provider, and security researchers who want paid review work. Its strengths are the range of services, the large researcher community and named protocol clients. The main caveat is that pricing is not published and key statistics are self-reported, so check the published audit reports and ask for scope and costs before committing. Retail users have little to do here beyond reading the reports.
Score breakdown
How Sherlock scores
- Security
- 7.5/10
- Ease of use
- n/a
- Fees
- n/a
- Features
- n/a
Scores run from 0 to 10 and are based only on facts we could verify. Where information was missing we mark the score n/a rather than guess.
What is Sherlock?
Sherlock is a Web3 security company. Its homepage offers collaborative audits, audit contests, an AI-driven Audit Engine and bug bounties, aimed at protocols, financial institutions and infrastructure teams. It also lists early-access pentesting, managed detection and response, and OPSEC services.
It began differently. DefiLlama still categorizes Sherlock as Insurance on Ethereum and describes it as a risk management protocol that paired protocol-to-protocol coverage with a decentralized security team. DefiLlama shows TVL of about $227,693, down 0.3% over seven days, and lists two audits and no token.
The homepage claims more than 1,500 audits and security reviews, 11,000+ registered researchers, 2,000+ criticals found and $250B+ in TVL secured. It also carries quotes from the founders of Aave Labs and Sky and from an Ethereum Foundation team member. These figures come from Sherlock itself and should be treated as marketing claims.
How Sherlock works
Sherlock sells security reviews at different stages of a protocol's life. In a collaborative audit, Sherlock assembles a small team of researchers chosen by performance and domain expertise to review a codebase privately. In an audit contest, many researchers review the code at the same time and compete to report the most impactful issues.
The Audit Engine adds AI-based analysis. According to the homepage, it coordinates multiple AI security approaches against the code and produces one validated result. After launch, bug bounties pay researchers who find problems in live code, and Sherlock's in-house team triages the reports.
Historically, DefiLlama describes Sherlock as combining protocol-to-protocol coverage with a decentralized smart contract security team. The homepage no longer mentions coverage, so how that product works today is not clear from public sources.
7 features
Key features
01
Collaborative audits
Private, staffed audits led by top-performing Web3 security researchers, with a curated team assembled for each engagement.
02
Audit contests
Open competitions where many auditors compete to find the most impactful issues in a codebase in a short time.
03
Audit Engine
An orchestration layer that coordinates AI security approaches against code and turns the output into one validated audit result.
04
Bug bounties
Incentives for hunters to test live code, with Sherlock's in-house team triaging findings as they arrive.
05
Lifecycle model
Offerings can be bought separately or combined across development, launch and live operation.
06
Researcher community
Leaderboards, ranked researchers and published audit reports give a view into the researcher community.
07
Early-access services
Pentesting, managed detection and response, and OPSEC are listed as early access additions.
Pros and cons
What we like
- Covers the full lifecycle: private audits, public contests, AI review and live bug bounties.
- Large registered researcher base, with leaderboards and public audit reports.
- Named case studies and endorsements from well-known protocols such as Aave, Sky and Morpho-related work.
- Services can be bought individually, so teams are not forced into a package.
- Transparent researcher side, with active bounties and reports visible on the platform.
Watch out for
- Pricing for audits, contests and bounties is not published, so teams cannot budget without contacting Sherlock.
- Headline figures such as $250B+ TVL secured and a 100% outperformance rate are self-reported and not independently verified.
- An audit or contest reduces risk but cannot guarantee a protocol is free of bugs.
- Several newer offerings (pentesting, managed detection and response, OPSEC) are listed as early access, so they are less proven.
- DefiLlama still lists Sherlock as Insurance with only about $227,693 in TVL, and the homepage does not explain the current status of the older coverage product.
- It serves teams, not retail users, so individual users get little direct use from it other than as a researcher.
Sherlock fees
Sherlock does not publish prices. The homepage directs teams to contact the Sherlock team, which suggests engagements are quoted case by case.
Bug bounty and contest rewards are presumably funded by the protocol being tested, but public sources give no amounts or terms. Teams and researchers should check the docs or ask Sherlock directly before committing.
Is Sherlock safe?
Sherlock is a service provider rather than a place where users deposit funds, so the main risk is the quality of the work and the reliability of its claims. The project does not say whether Sherlock's own contracts have been audited beyond DefiLlama listing two audits. Anyone relying on its audits should read the published reports and check scope.
No incidents or regulatory actions appear. Self-reported statistics like outperformance rate and TVL secured have no methodology shown publicly. A completed audit lowers risk but does not remove it, so teams should layer reviews, monitoring and bounties.
7 steps
How to get started with Sherlock
- 1
Decide which stage you need covered: pre-launch review, a public contest, AI review, or a live bug bounty.
- 2
Read the Sherlock docs and published audit reports to see the format and depth of past work.
- 3
Use the contact form to request a quote and timeline for a collaborative audit or contest.
- 4
Prepare your code, documentation and test suite so reviewers can start quickly.
- 5
Fix the reported findings and ask for verification of the fixes before deployment.
- 6
Consider a bug bounty after launch to keep outside researchers testing the live code.
- 7
If you are a researcher, register through the researcher section and check the leaderboards and active contests.
Who Sherlock is for
Sherlock is for teams that run high-value onchain systems, such as protocols, vaults, bridges, L1s and L2s, and for institutions moving assets onchain. It also suits security researchers who want to earn from contests and bounties. Ordinary DeFi users are not the target.
Sherlock FAQs
What is Sherlock?
Sherlock is a security company for onchain systems. Its homepage describes expert-led and AI-native security reviews for protocols, institutions and infrastructure teams across development, launch and live operation.
What services does Sherlock offer?
The homepage lists collaborative private audits, audit contests, an AI-based Audit Engine and bug bounties. Pentesting, 24/7 managed detection and response, and OPSEC are marked as early access.
Is Sherlock still a DeFi insurance protocol?
DefiLlama's description says Sherlock began as a risk management protocol combining protocol-to-protocol coverage with a decentralized smart contract security team. DefiLlama still lists it as Insurance on Ethereum, but the current homepage focuses on audits and security services.
Does Sherlock have a token?
DefiLlama shows no token for Sherlock. The project does not name a token ticker.
How much does a Sherlock audit cost?
Sherlock does not publish prices. Teams are directed to contact the Sherlock team, and costs likely depend on codebase size and the type of engagement.
Can individuals take part as security researchers?
Yes. The homepage says it has more than 11,000 registered security researchers and links to a researcher section with leaderboards, audit reports and active bug bounties. Payout terms are not given publicly, so check the platform rules.
Compare
Sherlock alternatives
Hats.V2 is a permissionless onchain marketplace for bug bounties and audit competitions, aimed at projects, security researchers and liquidity providers.
xAudits is a security firm for Solidity and Rust smart contracts, offering code reviews, protocol audits and remediation checks.
Quick Intel is an AI-assisted smart contract and token scanner aimed at crypto users checking for scams before trading.
Project Mimir is self-hosted osquery endpoint visibility software for security teams managing and investigating device fleets.
BICScan screens blockchain addresses, dApp domains, and EVM token contracts for users seeking an extra risk check before interacting.
Hawk Finance provides AI-powered AML, screening, fraud detection, and investigation software for banks, payment firms, and fintechs.
Same category
More Security dApps
NixGuard is a compliance preparation and endpoint monitoring platform for organizations working toward audits.
Forta is an on-chain monitoring and security network for developers, security teams and FORT holders considering staking.
Quantstamp provides audits and operational security services for Web3 teams seeking help assessing blockchain code and infrastructure.
SecureDApp offers blockchain security audits, threat monitoring, forensics, compliance, and development services for Web3 teams.
A token-scanning tool that simulates trades and checks contracts to flag honeypots and high taxes before you buy.
Cyberscan is a cybersecurity service for organizations that want domain scans, ongoing monitoring, and risk reports.
Same chain
More on Ethereum
Lido is a liquid staking protocol where users stake ETH and receive stETH, a reward-earning token usable across DeFi, governed by LDO holders.
Aave V3 is a non-custodial DeFi lending protocol on 21 chains where users earn interest on deposits or borrow against collateral.
Uniswap V4 is the latest Uniswap DEX version with hooks and concentrated liquidity, running on 22 chains for self-custody token swaps and liquidity provision.
Uniswap V3 is a non-custodial decentralized exchange protocol for token swaps and concentrated liquidity provision across 40+ chains.
DeFi Saver is a non-custodial tool for managing and automating leveraged lending positions across major DeFi protocols on Ethereum and layer-2 networks.
OKX is a major centralized crypto exchange for spot and derivatives trading, earn products and a Web3 wallet, with its own OKB token.
Guides
Guides that mention Sherlock
Wallets and tools
BlockFence API Browser Extension: What It Does and How to Vet ItBlockFence is presented as a browser extension backed by an API for screening sites and scripts. This guide explains how tools of this kind work, what the public sources do and do not confirm about BlockFence, and how to vet any extension before you trust it with a wallet.
Wallets and tools
Does Trust Wallet Use AI to Detect WAX Cloud Wallet Bots?Trust Wallet has announced a partnership involving WAX, but the sources available for this guide do not confirm an AI system that identifies WAX Cloud Wallet bots. This explainer separates what is verified from what is claimed, explains how bot detection works in general, and lists steps you can take now.
Wallets and tools
Hedera Token Service and the MetaMask Wallet Snap ExplainedHedera Token Service lets tokens be created and managed by the network itself rather than by custom contract code. The Hedera Wallet Snap adds Hedera accounts to MetaMask so you can hold and send those tokens from the same wallet you use for Ethereum-style apps.
Wallets and tools
MetaMask Trezor EIP-712 Support: What It Means in 2026MetaMask has added support for signing EIP-712 typed data through Trezor hardware wallets, so users can approve structured messages such as permits and login requests without exposing their keys. This guide explains what changed, how the pairing works, what problems users have reported, and how to check the feature in your own setup.
Wallets and tools
Mysterium Explained: How Its Decentralized VPN Protects Crypto UsersMysterium is a decentralized VPN network that routes your internet traffic through independent node operators instead of one company's servers. This guide explains how it works, what it can and cannot hide from crypto services, and how to use it with your wallets and exchange accounts more safely.
Wallets and tools
Polygon ID Explained: How Zero-Knowledge Identity WorksPolygon ID was a zero-knowledge identity toolkit that let people prove facts about themselves without handing over the underlying data. This guide explains how the model works, what it can and cannot protect, and how to check the project's current status.
How we checked
Sources
Last updated . Spotted an error? Tell us and we will correct it.