Cowrie Research

sherlock-primary-sources-2026-04-25

3 min read

Sherlock primary-source snapshot

Fetched: 2026-04-25 UTC

1) Official homepage

Source: https://www.sherlock.xyz/

Selected excerpts from the official site:

Complete Lifecycle Security for Web3 Protocols

Sherlock goes further than point-in-time audits.

Sherlock connects development, audit, and post-launch protection through a single integrated system.

Additional signals from the homepage:

  • The homepage emphasizes lifecycle security rather than just audit contests or a marketplace for researchers
  • Current product framing includes Sherlock AI, collaborative audits, audit contests, bug bounties, and Sherlock Shield
  • Customer proof points focus on large protocol teams and “TVL secured” style operating metrics, positioning Sherlock as institutional security infrastructure

2) Docs introduction

Source: https://docs.sherlock.xyz/readme.md

Selected excerpts from the docs:

Sherlock is a security organization built to protect onchain systems where software directly controls capital.

Security has to be an operating model.

Sherlock’s model is complete lifecycle security: coverage across development, auditing, and post-launch operation.

Additional signals from the docs:

  • The intro frames the company’s core thesis around continuity and “security memory” across releases, upgrades, and integrations
  • The docs enumerate six core services: Sherlock AI, Collaborative Auditing, Audit Contests, Bug Bounties, Sherlock Shield, and Blackthorn
  • This is strong evidence that the docs, not a whitepaper, are the clearest current source of truth for Sherlock’s product model

3) FAQ

Source: https://docs.sherlock.xyz/faq.md

Selected excerpts from the docs:

Sherlock is a leading Web3 security company for onchain systems where software directly controls capital.

It means security work that matches how protocols actually fail in production: invariants drift as features ship, upgrade paths introduce new trust assumptions, integrations change, and adversaries adapt.

Post-launch security is driven by incentive programs like bug bounties, which keep ongoing pressure on production systems.

Additional signals from the docs:

  • The FAQ adds practical explanations of how Sherlock distinguishes collaborative audits, audit contests, Blackthorn, and post-launch work
  • Vulnerability examples focus on fund-loss and invariant-breaking risks, which helps place Sherlock squarely in protocol-security operations rather than generic software QA

4) Sherlock Shield docs

Source: https://docs.sherlock.xyz/coverage/sherlock-shield.md

Selected excerpts from the docs:

Sherlock Shield is available for qualified codebases that complete an audit with Sherlock and meet the requirements for coverage.

If approved, Sherlock Shield provides exploit payout coverage for the covered code.

Payouts are determined by the on-chain claims process of the Sherlock protocol on Ethereum mainnet.

Additional signals from the docs:

  • Shield docs make the coverage layer concrete through eligibility steps, fix-review requirements, and coverage-amount tables rather than vague marketing copy
  • The mention of an onchain claims process is an important clue that Sherlock still includes protocol-like coverage infrastructure alongside the services business

5) Official GitHub organization

Source: https://github.com/sherlock-protocol

Selected excerpts/signals from the public org page:

Decentralized exploit protection

Core smart contracts of Sherlock V2

Sherlock audit and coverage reports

Additional signals from the org page:

  • Public repos include smart contracts, frontend, indexer, governance/discussion materials, integration allowlists, and report archives
  • The sherlock-reports repo is especially useful because it signals a large public corpus of audit / coverage artifacts, not just closed consulting engagements
  • The org page supports the view that Sherlock spans service delivery plus a protocol-ish exploit-protection layer

Notes

  • This pass did not locate a classic Sherlock whitepaper or litepaper from official sources.
  • The strongest primary materials were the homepage, docs introduction, FAQ, Shield docs, and GitHub organization.
  • Sherlock appears best categorized as a web3 security / audit / bug-bounty / exploit-coverage platform rather than as only an audit marketplace or only an insurance product.

Graph View