Sherlock
- Company typePrivate
- Founded2021
- HeadquartersMiami, United States
- Headcount101–250
- GTM typeB2B
- OfferingServices
What Sherlock does
Sherlock (legal entity Sherlock Protocol) is a Web3 security platform headquartered in Miami, founded in 2021 by Jack Sanford. The company provides lifecycle security for smart contract-based protocols, spanning the development stage through post-launch operation. Its core offerings are Sherlock AI, Collaborative Audits, Audit Contests, Bug Bounties, and Sherlock Shield (exploit coverage), with a Blackthorn elite audit tier reserved for high-stakes infrastructure reviews. The platform addresses a clearly defined pain point: traditional point-in-time audits leave protocols exposed to vulnerabilities introduced after the audit window, and Sherlock's model layers continuous discovery (bounties), AI-assisted pre-commit analysis, and optional financial coverage to close that gap.
Under the hood, Sherlock operates a community-sourced model with 11,000+ ranked security researchers whose performance data feeds team staffing decisions for each engagement. The Sherlock AI product combines a proprietary two-stage run architecture (discovery and verification) with a planner-and-specialists multi-agent system (Economic Logic, Math and Crypto, State Transition, Code Correctness, MEV Detection, External Integration, Access Control) and beta support for Solana Rust beyond EVM-only analysis. Sherlock Shield adds financial protection up to $500K for live protocols after a covered issue is exploited, layered on top of ongoing bug bounty programs.
Sherlock monetizes through professional services fees on collaborative audits and audit contests, managed-services and platform fees on bug bounty programs (including a stake-to-submit model at $250 USDC per report), insurance premiums on Sherlock Shield, and affiliate referral fees ($1,000 per qualified audit/AI referral, $500 per bounty referral). Customers span DeFi (Aave, Morpho, Sky, Maple, Perennial, Flying Tulip, Usual), L1/L2 infrastructure (Ethereum Foundation, Aptos, Mantle, Babylon, Cosmos/Interchain Labs), cross-chain (LayerZero, MegaETH), and RWA infrastructure (Centrifuge). The platform reports supporting protocols responsible for more than $250B in active TVL, completing over 1,000 private audits and 370+ audit contests, and surfacing 2,000+ critical issues cumulatively. Sherlock has raised $4M in seed funding (September 2022, led by Archetype with CoinFund, Lattice Capital, and The Spartan Group), operates with 1-10 employees, and has not disclosed additional funding or revenue.
Sherlock firmographics
Firmographics- Name
- Sherlock
- Legal name
- Sherlock Protocol
- Website
- https://sherlock.xyz
- Company type
- Private
- Founded year
- 2021
- Operating status
- Operating
- Headcount range
- 101–250 employees
- Ownership category
- akta.pro rank
Sherlock industry classification
Industry- Product category
- Web3 Smart Contract Security Services
- NAICS
- Security Systems Services (except Locksmiths) (561621), Security Systems Services (56162)
- SIC
- Security & Commodity Brokers, Dealers, Exchanges & Services (6200), Services-Detective, Guard & Armored Car Services (7381)
- akta.pro primary industry
- Bug Bounty, Vulnerability Disclosure & Security Services (FSAPAJAL)
- akta.pro secondary industries
- On-Chain Monitoring, Threat Detection & Incident Response (FSAPAJAB), Anti-Cheat, Security & Fraud Prevention for Web3 Games (bot detection, exploit prevention) (FSAPAGAL), Social Engineering / Funds Transfer Fraud Coverage (FSAJAOAI), Cyber Risk Management Services (Pre-Breach Services bundled with Insurance) (FSAJAOAO), Secure Model Deployment & Runtime Protection (sandboxing, isolation) (HDAAAKAH), Secrets Management (Passwords, API Keys, Tokens) (HDADAFAD), Insider Threat Program Design & Risk Assessments (BPAKADAM), Cyber Extortion / Ransomware Coverage (FSAJAOAH)
Keywords
Where Sherlock is headquartered
LocationHeadquarters
- HQ city
- Miami
- HQ country
- United States
- HQ region
- North America
Markets served
Sherlock business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Others
Revenue model
- Collaborative Audits: Private, senior-led audit engagements where Sherlock assembles a curated team from its ranked researcher network. Pricing varies by scope complexity, codebase size, and team composition. Teams like Blackthorn tier command premium pricing for high-stakes infrastructure reviews.
- Audit Contests: Time-limited competitive review competitions where protocols open their code to independent researchers. Sherlock takes a fee from the prize pool structure and engagement scoping. Prize pools can range from $100K to $2M+ (e.g., Ethereum Foundation Fusaka contest had $2M max prize pool).
- Bug Bounties: Ongoing vulnerability discovery programs for deployed protocols. Sherlock provides platform infrastructure, expert triage, and coverage options. Programs include stake-to-submit model ($250 USDC per report) with Sherlock providing adjudication and coverage up to $500K. Revenue from platform fees and coverage premiums.
- Referral Program: Sherlock pays referral fees to ecosystem participants who introduce protocol teams: $1,000 per qualified audit referral, $1,000 per Sherlock AI referral, $500 per bug bounty referral. Sherlock runs sales and delivery; referrers are compensated when customers purchase.
- Sherlock Shield Coverage: Optional exploit coverage product for qualifying audited codebases. Provides financial protection during live operation if covered issues appear. Includes post-exploit coverage up to $500K for bug bounty programs.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Other | Pay-as-you-go | Stake-to-submit bug bounty model with expert triage |
| Other | Pay-as-you-go | Referral fees for qualified introductions |
| Outcome Based/ Performance | One-time | Ethereum Foundation Fusaka audit contest prize pool structure |
| Outcome Based/ Performance | One-time | Flying Tulip ftPUT audit contest reward pool |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels7 records
Sherlock product offering
Product offeringCore offering
Sherlock provides lifecycle security services for Web3 protocols, combining AI-powered smart contract analysis (Sherlock AI), senior-led private audits (Collaborative Audits, including the Blackthorn elite tier), large-scale adversarial contests (Audit Contests), ongoing post-launch vulnerability discovery (Bug Bounties), and financial exploit coverage (Sherlock Shield). Engagements are staffed from a network of 11,000+ ranked security researchers matched to each protocol's architecture.
Product overview
Sherlock is a Web3 lifecycle security platform offering a unified, integrated system of security products spanning development, pre-launch auditing, and post-launch protection. The platform operates as a platform-plus-modules architecture with five core offerings: Sherlock AI (AI-powered smart contract analysis during development), Collaborative Audits (senior-led private reviews), Audit Contests (large-scale adversarial pre-launch reviews), Bug Bounties (ongoing post-launch vulnerability discovery), and Sherlock Shield (financial exploit coverage for live protocols). Blackthorn serves as an elite audit tier within the collaborative audit model, staffed by invite-only top researchers for the highest-stakes engagements. Supporting resources include Docs, Blog, Podcast, Case Studies, a Referral Program, a Lifecycle eBook, Leaderboards, and the Sherlock App. The platform is trusted by leading protocols including Aave, Ethereum Foundation, Morpho, Centrifuge, Perennial, MegaETH, and LayerZero.
Differentiator
Problem solved
Functional benefit
Brands
- Blackthorn: Sherlock's elite tier of auditors, reserved for high-stakes infrastructure and complex scopes, staffed by top-performing Web3 security researchers from Sherlock's network.
Products and services
- Sherlock AI AI-powered smart contract analysis tool that delivers auditor-level analysis during development for Web3 protocol teams, using a two-stage run system (discovery plus verification), domain-specific specialist workflows, and GitHub integration to catch vulnerabilities early.
- Collaborative Audits Private, senior-led code review engagements staffed from Sherlock's ranked researcher network. Sherlock assembles a curated expert team to review a protocol's codebase in a dedicated engagement with close developer collaboration, prior to mainnet or major releases.
- Audit Contests Time-limited competitive security reviews that open a protocol's codebase to hundreds of independent researchers competing to surface the most impactful issues, applying large-scale adversarial pressure before protocol launch.
- Bug Bounties Ongoing post-launch vulnerability discovery programs using a stake-to-submit model ($250 USDC per report, refunded if valid), with expert triage by Sherlock's lead auditors and a 52% hit rate on impactful submissions. Includes post-exploit coverage up to $500K for qualifying programs.
- Sherlock Shield Financial exploit coverage product for live protocols that have been audited, adding a protection layer during active operation if a covered issue is exploited. Includes post-exploit coverage up to $500K for qualifying bug bounty programs.
- Blackthorn Sherlock's elite audit tier, invite-only for top-performing researchers in the network and reserved for high-stakes infrastructure and complex scopes. Blackthorn researchers lead engagements on critical protocols such as Aave V4, Morpho Vaults V2, and the Ethereum Foundation Fusaka upgrade.
Quantifiable outcome
- Supports protocols with $250B+ in active TVL
- +4 more outcomes
Companies that use Sherlock
Customer profileNamed customers15 records
Segments1 record
Ideal customer profiles2 records
Sherlock technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration1 record
AI capability5 records
Feature9 records
Sherlock partnerships and signals
Strategic signalPartnerships
Two partnerships are on record, tiered flagship.
- UsualflagshipUsual partnered with Sherlock to launch the largest bug bounty in tech history at $16 million for a single critical vulnerability, eclipsing previous records by Uniswap ($15.5M) and LayerZero ($15M). The program covers Usual's full smart contract suite including stablecoin infrastructure, yield distribution, and governance contracts. Sherlock provides its stake-to-submit model with expert triage and post-exploit coverage.
- Ethereum FoundationflagshipEthereum Foundation's Protocol Security Team partnered with Sherlock for a large-scale audit contest as the final stress test before Fusaka's mainnet launch. The 28-day contest drew 510+ researchers with a $2M max prize pool. Sherlock mobilized its researcher network to surface 4 high-severity findings before the December 2025 Fusaka upgrade. The Foundation continues with an ongoing $250K bug bounty.
Scale indicators9 records
Recent moves6 records
Expansion highlights6 records
Sherlock competitors and assessment
Company assessmentDirect peers
- Code4rena: Code4rena operates audit contests and bug bounties for Web3 protocols, directly competing with Sherlock's contest and bounty offerings. Both platforms use crowdsourced reviewer models to surface vulnerabilities before protocol launches.
- Cantina: Cantina is a newer Web3 security platform offering audits, contests, and bug bounties with a curated researcher network. It competes directly with Sherlock across the audit contest and bug bounty product categories.
- Spearbit: Spearbit provides curated smart contract audit services led by senior security researchers. It directly competes with Sherlock's Collaborative Audits and Blackthorn tier engagements.
- Immunefi: Immunefi is the largest bug bounty platform specifically for Web3, directly competing with Sherlock's Bug Bounty product. Both platforms host ongoing vulnerability disclosure programs with major protocols.
- Zellic: Zellic is a smart contract audit firm specializing in cryptographic and high-stakes protocol audits. It competes for premium audit engagements similar to Sherlock's Blackthorn tier.
- Hacken: Hacken is a Web3 cybersecurity auditor offering smart contract audits, bug bounties, and security scoring services. It competes with Sherlock across multiple security service categories.
Broad incumbents
- OpenZeppelin: OpenZeppelin is a leading smart contract security and development firm offering audits, security libraries, and developer tools. It is a broader incumbent with overlapping audit services but a different model (fixed roster of senior auditors rather than crowdsourced).
- Trail of Bits: Trail of Bits is a well-established cybersecurity firm with significant Web3 smart contract audit practice. It competes for high-stakes audit engagements (e.g., Aave, Morpho) and offers broader security services beyond Web3.
- Consensys Diligence: Consensys Diligence is the audit arm of Consensys, one of the largest Web3 infrastructure companies. It offers smart contract audits and competes for major protocol engagements as a broader incumbent.
Emerging players
- Certora: Certora provides formal verification and security analysis tools for smart contracts. It is an emerging player using a different technical approach (formal verification) that overlaps with Sherlock AI's pre-launch analysis capabilities.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks5 records
Key highlights7 records
Customer concentration
Sherlock social profiles
Digital presenceSherlock financial estimates
Financial estimateRevenue estimate
Valuation estimate
Sherlock leadership team
Management profileNumber of profiles
Profiles2 records
Sherlock funding detail
Funding detailFunding overview
Funding rounds1 record
Investors5 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Sherlock M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Sherlock
What does Sherlock do?
Sherlock provides lifecycle security services for Web3 protocols, combining AI-powered smart contract analysis (Sherlock AI), senior-led private audits (Collaborative Audits, including the Blackthorn elite tier), large-scale adversarial contests (Audit Contests), ongoing post-launch vulnerability discovery (Bug Bounties), and financial exploit coverage (Sherlock Shield). Engagements are staffed from a network of 11,000+ ranked security researchers matched to each protocol's architecture.
Is Sherlock a public or private company?
Sherlock is a private company. It is classified as venture growth investor backed and is currently operating.
When was Sherlock founded?
Sherlock was founded in 2021. It employs 101 to 250 people.
Where is Sherlock based?
Sherlock is headquartered in Miami, United States, in the North America region.
How does Sherlock make money?
Five revenue lines are on record. Collaborative Audits are the primary driver. The others are audit Contests, bug Bounties, referral Program and sherlock Shield Coverage.
Who are Sherlock's main competitors?
Direct peers on record are Code4rena, Cantina, Spearbit, Immunefi, Zellic and Hacken. Broad incumbents are OpenZeppelin, Trail of Bits and Consensys Diligence. Certora is listed as an emerging player.
Does Sherlock have an API?
No public API is recorded for Sherlock.
What industry is Sherlock in?
Sherlock's product category is Web3 Smart Contract Security Services. Its primary akta.pro industry code is FSAPAJAL, Bug Bounty, Vulnerability Disclosure & Security Services, with a secondary code of FSAPAJAB, On-Chain Monitoring, Threat Detection & Incident Response. Its NAICS code is 561621 and its SIC code is 6200.