Sherlock for Web3 teams
Web3’s leading teams trust Sherlock with their most critical code.
Sherlock brings specialist researchers and AI-native auditing to your codebase. Engage us for a single audit or an ongoing security program.
An attacker only needs one exploitable path to user funds.
Contract flaws, compromised access, and vulnerable dependencies can each expose the user funds your protocol manages.
Diagram: four attack paths lead to user funds at risk. A contract flaw leads to unintended execution. An OpSec failure leads to a privileged transaction. A compromised interface leads to a malicious approval. A manipulated price input leads to an incorrect valuation. Each can cause loss or unauthorized movement of assets.
Sherlock Analysis
Attack vectors and defense standards: Where to bolster security strength in 2027
The gaps attackers exploit across code, infrastructure, and operations, and the controls that help close them.
Read the ArticleSherlock’s complete security offering, from development to live protection.
Engage Sherlock for a single audit or connect services across your release cycle. The work is scoped to your codebase, operating model, and the funds at risk.
Service
Security work
Deliverables
Private auditing
Security work
Specialist researchers test your code and critical assumptions. Work directly with the audit team through remediation and fix verification.
Deliverables
Validated findings, remediation guidance, fix verification, and a final audit report.
Audit engine
Security work
Use AI-led reviews during development. For launches and critical code, combine AI engines with specialist researchers at the depth your release needs.
Deliverables
Validated findings, with duplicate reports consolidated by root cause.
Bug bounties
Security work
Give researchers an incentive to find vulnerabilities in live code. Sherlock validates reports and manages triage with your team.
Deliverables
Defined program scope, staked submissions, validated reports, and Sherlock-led triage.
OPSEC
Security work
Harden keys, privileged access, and signing workflows. Define emergency authority and rehearse the actions your operators may need to take.
Deliverables
Signer and access design, runbooks, training, and drill results.
Pentesting
Security work
Test the frontends, APIs, wallets, and infrastructure your protocol depends on. Sherlock validates findings and retests fixes.
Deliverables
Prioritized findings, reproduction steps, remediation guidance, and fix verification.
24/7 Managed Detection and Response
Security work
Monitor risks across your protocol and its dependencies. Sherlock investigates alerts around the clock and coordinates response with your incident lead.
Deliverables
Monitoring rules, escalation contacts, and response runbooks.
Complete Lifecycle Security
Sherlock built this model for Web3 teams shipping code that users and other protocols depend on.
Diagram of Sherlock’s lifecycle model. 01 Development: review code and operational controls. 02 Deployment: audit releases before they go live. 03 Live protection: find vulnerabilities, detect and respond. New code and upgrades loop back to development. Sherlock: one connected security model.
Audit findings, fixes, and observations from production carry forward into the next review. With each release, Sherlock builds a deeper understanding of how your protocol works.
Leading Web3 teams choose Sherlock to audit critical code.
Sherlock secures the infrastructure that moves and manages capital onchain. We bring that firsthand experience to secure the onchain products leading teams build and operate.
~75,000
LOC reviewed
Upgrade-specific review across consensus and execution clients, with findings remediated before mainnet.
~25,000
LOC reviewed
Review across core DeFi contracts, governance, staking, and savings modules.
$250B+
Active TVL across DeFi protocols Sherlock supports.
1,500+
Audits and security reviews
Security across the ecosystems your team builds on.
From core-network upgrades to production applications, Sherlock reviews the systems behind the ecosystems your team uses.
Core protocol upgrades
Sherlock reviews Ethereum’s core upgrades and the protocols built on it, including lending markets and vaults from Aave and Morpho.
OP Stack infrastructure
Our work spans the infrastructure Base runs on and the protocols building its trading and lending markets.
Application-level security
Sherlock works with the protocol teams building new financial markets on Robinhood Chain.
Client testimonials
“Aave has always implemented industry-leading security standards. V4 is designed to bring trillions of dollars and millions of users onchain, so continuing to meet those standards was not negotiable. Sherlock’s collaborative audit provided a deep review from a specialized team, and the public contest that followed confirmed their work was effective.”
Stani Kulechov
Founder and CEO of Aave Labs
“Rock solid security has always been a priority for Sky. Over time, it’s become one of the defining features of the project. It only makes sense that the team would work with the market leader, Sherlock.”
Rune Christiansen
Founder of Sky
“We chose Sherlock because we were intrigued by the value of having multiple independent security researchers collaborating together. Our favorite part was the collaborative environment and effective feedback cycle between our team and Sherlock, making it a very productive experience.”
Fredrik Svantes
Ethereum Foundation
Security work that follows your code into production.
Your engineers get verified findings before release and a coordinated response when live systems are threatened.
Upgrade diff review
Audit changes against the deployed implementation, with attention to storage layout, access controls, and fund flows.
Upgrade findings ranked by severity
Fix verification
Retest affected code paths in the patched release candidate.
Fixes verified before deployment
Deployment review
Check the planned upgrade transaction against the reviewed implementation and configuration.
Deployment parameters verified before signing
Ship safer releases. Protect user funds.
Ship with verified fixes and a clear response plan when live systems put user funds at risk.
Fewer flaws reach production
Safer signing and deployment
Coordinated incident containment
Leading Web3 teams choose Sherlock.
Tell us what you’re building or upgrading. We’ll scope the right audit or security engagement for your codebase, timeline, and team.
Contact our team