Sherlock

Sherlock provides smart-contract audit coverage for DeFi protocols. Security researchers and stakers back a first-loss capital pool that pays out when covered protocols suffer exploits matching policy terms.

Ties underwriting directly to audit coverage — protocols pay premiums and stakers backstop exploit losses on audited codebases.

- Audit Cover / Sherlock Shield: Financial coverage that reimburses protocols for losses from smart-contract exploits that should have been caught during a Sherlock audit. Historically offered up to $10M per protocol under the V2 staking model; the current Sherlock Shield product sits on top of audited code post-launch with limits up to $500,000 and is explicitly described as 'not insurance', with payouts governed by written program terms and claims processes. - USDC Staking Pool (V2, first-loss capital): A single Ethereum-based underwriting pool where stakers locked USDC to backstop coverage payouts. Stakers earned cover-purchase fees, yield-strategy returns and SHER token incentives, but bore first-loss risk: staked capital could be liquidated to pay valid exploit claims. - Audit Contests: Large-scale adversarial competitions where thousands of registered security researchers compete to find vulnerabilities in a protocol's codebase for a prize pool, with severity-based scoring. - Collaborative Audits: Private, staffed security reviews led by top-ranked researchers, offered as a pre-launch complement or alternative to open contests. - Bug Bounties: Ongoing post-launch incentive programs for live protocols, including record-size bounties (e.g. a $16M program for Usual). - Sherlock AI: AI-driven automated code-analysis tool (beta launched September 2025) that scans smart-contract code during development to surface vulnerabilities earlier in the lifecycle. - Claims Assessment (SPCC + UMA): Two-stage claims process: the Sherlock Protocol Claims Committee (core team + security advisors) votes within ~7 days; denied claims can be escalated to UMA's Optimistic Oracle for arbitration for a fixed fee. - SHER Token: Native protocol token used for staking rewards and researcher incentives. Note: SHER was never launched as a liquid, publicly traded token; the planned large public token round did not result in a live token.

- Smart Contract: The entire coverage product is exposed to smart-contract exploit risk: valid claims (e.g. the $4.5M Euler payout) draw directly from the USDC staking pool, and the underwriting contracts themselves are attack surface. - Reserve / Depeg: The coverage pool was severely undercapitalized relative to outstanding exposure: reserves fell ~90% to ~$2.9M while $16.5M of cover was live, meaning a single large claim could exhaust reserves and leave cover unpaid. - Counterparty: Sherlock deposited staker USDC into external yield venues (Maple Finance) and lost ~$4M when borrower Orthogonal Trading defaulted after FTX exposure, showing coverage capital was exposed to third-party credit/counterparty default. - Governance: Claim outcomes depend on the Sherlock Protocol Claims Committee (core team + advisors) with escalation only to UMA's Optimistic Oracle; claimants face discretionary, centralized first-pass decisions and a fee to escalate. - Systemic: Coverage mispricing (protocols charged far less than the loss frequency warranted) plus stakers rushing to withdraw during the 2023 crisis created a run-risk that threatened the viability of the whole coverage model, ultimately forcing a pivot away from staker-funded cover.

- Warranty / audit-linked professional-liability cover: similar — Like a warranty on professional work, Sherlock's Audit Cover pays out when the audited 'product' (smart-contract code) fails due to a defect the audit should have caught, aligning the auditor's incentives with the client's outcome.; differs — Cover is funded on-chain by USDC stakers taking first-loss risk rather than by a regulated insurer's balance sheet; claims are decided by a protocol committee plus UMA's Optimistic Oracle rather than courts or regulators; limits are modest and the product is explicitly 'not insurance'. - Surety bond: similar — A third party (the staking pool) posts capital that can be drawn on if the covered party's code fails, similar to how a surety guarantees performance and pays the obligee on default.; differs — There is no legal recourse against a principal to recover paid claims; the 'surety' capital is crowdsourced from anonymous USDC stakers earning yield, and pricing is tied to audit quality scores rather than credit underwriting.