Sherlock Review: Is It Worth Hiring for Security?

Sherlock is a security provider for teams building onchain systems, rather than a crypto app where you deposit assets or trade. Its current service menu covers private collaborative audits, open audit contests, an AI-assisted Audit Engine and bug bounties for deployed code. Teams can use one service or combine them across development, launch and live operation.

A private audit is a scoped review led by a selected researcher team. A contest brings multiple researchers to review a codebase competitively. The Audit Engine coordinates AI security approaches and validates results, while a bug bounty invites researchers to report vulnerabilities in live systems. Sherlock says its services are for protocols, infrastructure providers, financial institutions and other teams responsible for onchain systems.

That menu gives project teams several ways to seek review, but it does not mean every service is suitable for every codebase or risk. Ask which contracts, versions and dependencies are included, and whether the engagement covers integrations or only the submitted code. An audit is not a guarantee that a system is free of vulnerabilities.

Sherlock does not publish standard prices on its current site. You will need to contact the company for a quote, and the cost may depend on the service and the work’s scope. The site describes multiple engagement types but does not provide a rate card, contest budget requirements, bug-bounty funding minimums or a standard timeline.

Get a written proposal before you commit. It should identify the code and versions being reviewed, the review method, delivery dates, report format, and whether retesting fixes is included. For a bug bounty, confirm the reward pool, eligible code, severity rules, disclosure process and who decides whether a report qualifies. For an AI-assisted review, clarify what human validation and remediation support are part of the engagement.

Compare quotes on scope and deliverables, not just headline price. A lower fee may cover less code or fewer follow-up services. If the proposal is unclear about exclusions, ask for them to be spelled out. Without public pricing and standard terms, you cannot calculate value in advance from the website alone.

Sherlock’s site describes a security business and lists services, case studies and customer testimonials. It also claims a track record that includes more than 1,500 audits or security reviews, over 2,000 critical issues uncovered and more than $250 billion in TVL secured. Those are company-reported figures, not a guarantee that Sherlock will find a flaw in your code or that an audited protocol is safe.

The site does not publish a Sherlock-specific security audit, licence information or detailed incident history. Before sharing sensitive code or paying for work, check the legal entity you will contract with, the engagement terms, confidentiality protections, payment arrangements and dispute process. Review relevant past audit reports and the credentials of the researchers assigned to your project.

An audit reduces some risk but cannot eliminate it: bugs can be missed, code can change after review, and operational or economic failures may fall outside the scope. If you are considering Sherlock for insurance, do not treat its security services as proof that coverage exists. Get the covered risks, exclusions, limits and claims process explicitly documented.

Sherlock’s offering is organized around different stages of a project’s security lifecycle. You can contact the team about a single audit or use separate services for contests, AI-assisted reviews or live-code bounties. Its site also provides routes for researchers, including audit reports, active bounty information and a platform for audit work.

This is a business-to-business service rather than a self-serve consumer product. The homepage directs prospective clients to contact the team, but does not publish a standard sign-up flow, turnaround times, supported payment methods or a mobile-app experience. If you are a protocol team, expect to discuss the codebase and requirements before selecting an engagement.

Ask how Sherlock selects and supervises researchers, how findings are triaged, and what happens if a critical issue is found during a review. For a contest or bounty, establish the reporting and response process before code is exposed to participants. Keep control of deployment keys and administrative permissions; a security review should not require handing over custody of your protocol’s funds.

Sherlock’s public service description does not lay out a clear DeFi insurance policy. It does not give coverage limits, eligible protocols, exclusions, premiums, claim conditions or a claims process. Its current site focuses on security services, so teams and users should not assume that an audit, contest or bug bounty protects them against financial losses.

There is also no published standard pricing to compare across Sherlock’s service lines. The company’s headline performance claims do not replace engagement-specific evidence: you still need to understand who will do the work, what code is in scope, how findings are ranked and what remediation support you receive. Ask for relevant reports and confirm that the reviewed version matches the code you plan to deploy.

Sherlock may suit teams that want a combination of expert and competitive review, but it is less straightforward for buyers who require fixed public prices or ready-to-check insurance terms. Treat each engagement as a defined security service, not a certification or safety guarantee. If coverage is your priority, request a separate written policy and verify exactly which risks it covers before relying on it.