For a normal DeFi user: Sherlock Shield does not cover you. It pays the protocol team for exploits in Sherlock-audited code, is capped at $500k, has no public terms, and Sherlock states funds are not guaranteed. If you want cover you can personally claim on, see the buyable analyses.
Sherlock is primarily an audit and contest platform. Its cover product, Sherlock Shield, pays out only for exploits in code Sherlock itself audited, is capped at $500,000, and is sold to protocol teams, not end users. This profile examines how much protection that promise really contains. Facts, not advice.
Who this is for: Protocol teams combining an audit with a coverage commitment (payout goes to the TEAM)
A narrow but transparently framed product. The dispute process with UMA escalation is a distinctive design and the Euler payout is a documented track record. On the other side, coverage is capped at $500k, terms are private per engagement, and Sherlock states that neither payment nor availability of funds is guaranteed. The Raccoon Score rates Shield on the builder rubric, for its actual buyer, the protocol team; retail users have no claim under this product at all. The low score reflects the private terms, the $500k cap, the non-guaranteed funds and that the payout is not committed to reach the users, and is not a verdict on Sherlock as an auditor, which is top-tier.
Data confidence: low · Assessment as of 2026-07-28
How to read this page: where each value comes from
On-chainRead from contracts, verifiable by anyone at any time.
Contract docFrom a binding written document, off-chain but checkable.
Provider claimStated by the provider, off-chain: a matter of trust.
Third partyFrom a third-party source, off-chain: a matter of trust.
Our assessmentOur judgement under the Raccoon methodology.
Only on-chain values are verifiable without trusting anyone. Everything off-chain, including binding documents, ultimately relies on trust in the source.
Live on-chain On-chain
Reading the chain…
Profile
ProviderSherlock (audit firm plus coverage protocol on Ethereum) Provider claim
Audit business, for context370+ completed audit contests, 11,000+ registered researchers; 2025-2026 clients include Ethereum Foundation, Aave, Morpho and LayerZero (per Sherlock’s public portal). Backs the "top-tier auditor" framing in the verdict below - this is about the audit side, not Shield adoption, which is not published. Provider claim
Who is coveredProtocol teams only. Sherlock states explicitly: users should not assume they will be reimbursed Provider claim
Legal natureNot insurance (own disclaimer). Coverage governed solely by private, per-engagement written terms Provider claim
Maximum coverage$500,000 per codebase, tiered down to $1,000 based on audit findings score Provider claim
Payout guaranteeNone. Sherlock: "does not guarantee payment or the availability of funds" Provider claim
Claims settlementPayouts run through the on-chain claims process of the Sherlock protocol on Ethereum mainnet Provider claim
The key structural point: Shield is an accessory to the audit business, not a standalone insurance pool. Coverage exists only for code Sherlock audited, the amount depends on how clean the audit was, and the buyer is the protocol team. For a DeFi user this product provides no direct claim at all. For the protocol team itself the calculus is different: Shield comes bundled with the audit and its skin-in-the-game pricing, but is capped at $500k with no payout guarantee. Teams that want materially larger protocol-layer protection for their users can compare Nexus Mutual Native Protocol Cover, where a team buys up to $25M of cover that pays its users (per Nexus documentation).
What is covered Provider claim
No public, binding cover wording exists; the following is compiled from provider documentation. Final terms are set per engagement and are not public, which is itself a finding.
1 covered2 conditional4 excluded
Covered
Exploit in Sherlock-audited codeCore promise: covered issues in the audited, fix-reviewed scope during the chosen coverage window.
Excluded
Code outside the audited scopeOnly audited and approved contracts qualify; scope defines the protection boundary.
Excluded
Changes deployed after the auditUpgrades, new deployments and config changes after review change the risk profile and fall outside coverage.
Excluded
Losses above the coverage capHard cap of $500k; at Euler, the $4.5M payout equalled roughly 2% of the $200M loss.
Excluded
End-user lossesPayouts go to the protocol team; Sherlock does not control whether users are made whole.
Conditional
Oracle failure, governance attacks, depegsNo public event catalogue; whether an event qualifies depends on the private engagement terms.
Conditional
Phishing, key theft, frontend attacksNot addressed in public documentation; presumably outside the audited-code promise. Not verifiable.
Conditions attached Provider claim
EligibilityFive-step process per Sherlock’s own docs (checked 23 Jul 2026): complete a Sherlock audit, complete the fix review, Sherlock evaluates the codebase for Shield eligibility, scope/coverage/final terms are confirmed, then coverage starts if approved. Not automatic and not included with every audit.
Coverage amount (full public ladder)Score-based and checkable. Points: Medium finding = 1, High = 5, times an audit-type multiplier (Recommended 0.75, Minimum 1.0, Private and Collaborative 1.5, Best Efforts 2.0). Cover by points: 0 = $500k, under 3 = $250k, under 6 = $200k, under 9 = $150k, under 12 = $100k, under 15 = $50k, under 18 = $25k, under 21 = $10k, under 30 = $5k, 30 or more = $1k. Fewer and less severe findings mean more cover.
Coverage windowTeam selects a time-bound protection window; coverage applies only within it
Dispute costsEscalation to the 7-member claims committee costs $1k; further escalation to the UMA Optimistic Oracle costs roughly $15k, half refunded if the claimant wins. The committee has operated for over three years and has ruled on multi-million dollar cases (Sherlock docs, checked 23 Jul 2026).
NegotiationSupervised negotiation allowed, capped at 14 days, only in Sherlock-moderated channels
Worked example (checkable)Gamma Staking contest, May 2024: 0 High and 2 Medium valid findings per the public judging repo. Points: 2 x 1 = 2, below 3 even after any audit-type multiplier, so up to $250,000 Shield coverage. Because contest results are public, this part of the promise is verifiable by anyone; whether Gamma actually bought Shield is not public.
Analysis as of 2026-07-28. Live figures update every 5 minutes from the contracts. Not affiliated with Sherlock. Informational only, no legal, investment or insurance advice.