Complete Lifecycle Security For Onchain Systems. Leading teams choose Sherlock for private audits, AI-native review, bug bounties, and institutional security.
Joined February 2021
- Tweets7.3K
- Following1.9K
- Followers28.4K
- Likes9.3K
Pinned Tweet
Sherlock Audit Engine has officially secured upgraded approval for managed client audits under the @AnthropicAI Cyber Verification Program.
We can now run Claude Mythos 5.1 and other frontier models from Anthropic through Audit Engine to expand vulnerability coverage across client codebases.
The public Audit Engine engagement with @ArcadiaFi kicks off tomorrow, Nov 12, at 9 AM ET!
Arcadia is building the infrastructure to deploy and manage liquidity across decentralized markets, with automation and leverage built in.
Prize pool and signup ↓
Submissions close Nov 30 at 9 AM ET.
Total prize pool
• $10K guaranteed
• $30K if a Medium finding is accepted
• $50K if a High finding is accepted
Sherlock will select the strongest applicants. KYC and an NDA are required.
Apply ↓
audit-engine.sherlock.xyz/en…
1
7
481
The Binance hack 2 weeks ago exposed how fragile operational security remains in crypto.
A compromised laptop became a route to wallet signing systems. $6.3B in assets were affected.
We break down what failed and what crypto teams need to fix.
sherlock.xyz/post/web3-opsec…
1
298
Sherlock retweeted
Great to have @Uniswap back for another Audit Engine.
The new meta is trying a bunch of different approaches to securing code (AI + human), and this is what Audit Engine is for.
For example, AI approaches that failed 3 months ago are now topping the leaderboards.
Announcing a new @Uniswap Audit Engine engagement!
Solidity codebase. 10-day submission window. Kicks off Friday, November 6.
Signups are open - Places are limited, and Sherlock will select the strongest applicants.
Reward details and how to apply below ↓
Findings-based rewards:
• Critical: $100,000 per unique finding, capped at $250,000
• High: $25,000 per unique finding, capped at $100,000
• Medium: $5,000 per unique finding, capped at $50,000
• Low / Informational: $20,000 fixed pool
Caps apply per severity across the entire engagement, not per researcher.
Sign up for a chance to participate: audit-engine.sherlock.xyz/en…
1
8
1,021
In a recent Audit Engine engagement, five specialist Web3 AI auditors contributed 14 accepted Medium/High findings.
GPT-5.6 Sol, run as an LLM agent configured by Sherlock, contributed seven accepted Mediums. Five overlapped with the auditors’ findings. Two were credited only to GPT-5.6 within the engagement.
We measure marginal coverage: the accepted vulnerabilities a system adds beyond the existing reviewer set.
Here, GPT-5.6’s smaller standalone finding set expanded the combined result from 14 to 16 distinct accepted Medium/High findings - a 14.3% increase after judging and deduplication.
We build model mixes around what each system adds to the combined review.
Our proprietary performance data from real engagements helps us identify complementary AI auditors and LLM configurations for different codebases and refine future mixes.
Start an AI-only review for your protocol with Audit Engine:
sherlock.xyz/solutions/audit…
5
451
Congratulations to the @Onlend_ team on coming out of stealth!
To celebrate, we’re kicking off a public Sherlock Audit Engine engagement on November 23 to review their onchain lending infrastructure.
Public signups are coming soon.
Institutional-size trades. Private quotes. Atomic settlement.
@SwapMonster_ brings request-for-quote trading to Canton, using Daml contracts to exchange assets and payment in one transaction.
Sherlock has completed a collaborative audit of its RFQ exchange. ↓
Sherlock retweeted
And I thought the crypto was faring well in Black October.
Sherlock is dedicating significant resources to operational security for teams this year, including hiring @_AurelienDo, Sherlock's new CISO and Head of OpSec.
Code security losses have become a blip on the radar compared to operational security losses in Web3 this year. I'd like to think that's because Sherlock and others have done their job well in code security.
It's time for us to turn our attention to operational security.
We can't mandate that our audit customers use our operational security services, but going forward we will make it very easy for teams to protect their entire surface area with Sherlock, not just their onchain risks.
A $6.3B hack at the world’s largest crypto exchange is a wake-up call for every organization responsible for protecting funds onchain.
Early findings suggest a compromised engineer’s laptop gave an attacker access to systems used to submit withdrawals. Funds were taken across ten blockchains. The full root cause remains under investigation.
An exchange holding this much customer capital needs controls that contain an intrusion before it becomes billions in unauthorized transfers. Replacing losses afterward cannot substitute for preventing them.
Most of the $6.3B was stolen in roughly 20 minutes.
As more assets move onchain, these failures put more capital at risk. More integrations, providers and privileged accounts create more routes to secure. Attackers already target employees and wallet providers; larger potential payouts give them more incentive.
Teams need to know who can reach their signing infrastructure, what they can authorize, which controls remain independent during a compromise, and how quickly they can detect and stop an intrusion.
We’re putting more of Sherlock’s work into opsec: tracing how access to an organization can become access to its funds, and helping teams close those paths.
In order for the world’s financial system to run onchain, protecting its assets has to mean securing everything with the authority to move them.
A $6.3B hack at the world’s largest crypto exchange is a wake-up call for every organization responsible for protecting funds onchain.
Early findings suggest a compromised engineer’s laptop gave an attacker access to systems used to submit withdrawals. Funds were taken across ten blockchains. The full root cause remains under investigation.
An exchange holding this much customer capital needs controls that contain an intrusion before it becomes billions in unauthorized transfers. Replacing losses afterward cannot substitute for preventing them.
Most of the $6.3B was stolen in roughly 20 minutes.
As more assets move onchain, these failures put more capital at risk. More integrations, providers and privileged accounts create more routes to secure. Attackers already target employees and wallet providers; larger potential payouts give them more incentive.
Teams need to know who can reach their signing infrastructure, what they can authorize, which controls remain independent during a compromise, and how quickly they can detect and stop an intrusion.
We’re putting more of Sherlock’s work into opsec: tracing how access to an organization can become access to its funds, and helping teams close those paths.
In order for the world’s financial system to run onchain, protecting its assets has to mean securing everything with the authority to move them.
Sherlock retweeted
Changing tokenization on-chain on @solana and improving the state of the trenches takes fully custom & in-house novel code. Not many are willing to do that anymore due to high cost of integrations, auditing, and difficulty of building from scratch to get distribution
Way easier to just fork the same shit everyone else is running
To keep up and actually make the platform safer, you can’t just push code to prod after a quick AI checkup and pray it holds
More than ever we need proper quality audits, therefore I can fully recommend @sherlockdefi and it shows as this is already the second audit they’re handling for us
I am really excited about what’s coming next, can’t wait!
Thank you to @sherlockdefi for completing the smart contract audit for RISE V2
Launch details will be announced in the coming days
Sherlock has completed a collaborative audit of RISE V2 by @risedotrich.
V2 brings a reserve-backed rising floor and liquidation-free borrowing to token launches on @solana.
Rewards paid in USDC:
Critical: $50K–$500K
High: up to $50K
Medium: $1K–$10K
Low: up to $1K
Reports must include a coded PoC and run instructions demonstrating an exploit achievable in production.
Get started here: audits.sherlock.xyz/bug-boun…