Sherlock can provide coverage against exploits and bug bounties. If your protocol experiences an exploit, Sherlock can help pay to reimburse your LPs and users. If you have a large bug bounty payout, Sherlock can help pay for it.
Let’s say you’re about to launch on mainnet. You may want to set up a bug bounty program so that any vulnerability discovered can be responsibly disclosed instead of being exploited by a black hat hacker. You may offer $500k, $1M or even $5M to whitehats who responsibly disclose a critical-severity vulnerability through your bug bounty program.
However, it’s expensive to pay $1M to a whitehat. And who knows, 2 critical vulnerabilities could be disclosed to you in the same week. Can your treasury and runway handle two $1M payouts in a week? Alternatively, you can use Sherlock coverage. In this way, you can pay a smaller monthly cost to Sherlock (let’s use $50k as an example) and then Sherlock will pay out any $1M critical bug bounty submissions that arise. This allows you to have a large bug bounty program while still having visibility into your burn rate before you raise that next round.
Similarly, you can sign up for exploit coverage with Sherlock as well. If you’re about to launch and you want to win over some LPs who would participate on Day 1, you can offer exploit coverage on their LP position. LPs love this because they know that smart contract hacks are a huge risk for any new protocol launch. Sherlock coverage can help you bootstrap early liquidity for your protocol.
Your experience is very simple:
In the spirit of decentralization and trustlessness, much of Sherlock’s coverage process occurs on-chain and is defined by smart contracts. You can see the contracts here.
These on-chain smart contracts (the Sherlock Protocol) contain funds (mainly USDC) staked by LPs. LPs stake funds into the protocol because they earn rewards (APY) for doing so. This APY largely comes from monthly payments by protocol teams and SHER token rewards.
The funds to pay for your bug bounty payouts or an exploit on your contracts come from the LPs who have staked funds in the Sherlock Protocol.
You must pay a monthly subscription to be registered in the protocol and submit a valid claim to get access to these funds.
The monthly subscription cost is in USDC. You can pay for 1 month at a time, 3 months at a time, or any amount you choose. And if you want to cancel, you can do so at any time and you’re only charged for the following week. Any payment in the smart contracts beyond 1 week is refunded to you. So there is little risk of overpaying.
The cost of coverage depends on a number of factors such as the size and complexity of the codebase, as well as the number of vulnerabilities found in the Sherlock audit. Only smart contracts that have been through a Sherlock audit get access to coverage.
For example, maybe you want a $500k bug bounty policy. This could mean you pay $25k per month. And if a Critical severity bug bounty is submitted to you, Sherlock can pay the $500k amount (minus any deductible) instead of you. This allows you to have more insight into your runway and burn rate.
When a valid critical bug bounty is submitted to your bug bounty program or an exploit occurs on your smart contracts, you can initiate a claim through the Sherlock smart contracts. You will have whitelisted an address for a wallet you control, and you can send the claim transaction using that wallet. This section outlines the claims process in more detail. If your claim is deemed valid, a payout can occur in as little as 7 days.