Hello Superfluid community,
We’re thrilled to introduce Sherlock as a candidate to become Superfluid’s trusted security partner. At Sherlock, we specialize in providing top-tier security solutions for Web3 projects like Superfluid, and we’re proud to have already conducted an audit contest for Superfluid in the past. Building on that foundation, we’re excited to take the next step in strengthening our relationship by designing and hosting a bug bounty program for Superfluid.
Introduction to Sherlock
Sherlock is a leading security company dedicated to safeguarding Web3 through its revolutionary audit contests, where the world’s top security researchers compete to identify vulnerabilities in users’ code bases. Our unique approach combines the meticulous focus and collaboration of traditional audits with the extensive participation of security experts from our audit contests, creating a “best of both worlds” solution.
Our extensive experience and proven success are highlighted by:
- Over 250 audits completed with a 98% success rate of finding at least a Medium-severity vulnerability.
- Over $2.0mm awarded to Sherlock to manage multiple security grant programs by some of the largest protocols.
- One of the largest audit contests in history for MakerDAO with a value of $1.4mm.
- Multiple case studies highlighting the effectiveness and efficiency of our services:
- Tokemak Case Study
- Index Coop Case Study
- Ajna Finance Case Study
- Perennial Case Study
Sherlock’s consistent track record of exceeding expectations has fueled high demand for our audits, supported by the number of projects that return for a second audit after their initial success. This list includes:
Optimism, GMX, Ajna, LooksRare, Gitcoin, Index Coop, Rio Network, Opyn, Notional, OlympusDAO, Lyra, Perennial, Sentiment, Symmetrical, BOND Protocol, Merit Circle, DODO, JOJO, NounsDAO, Footium, Illuminate, Union Finance, Unstoppable/Alchemix, WAGMI, Blueberry, Telcoin, Cooler, Teller, Sense and many others.
What We Do
Sherlock offers a two clear services that align with Superfluid’s needs:
Bug Bounty
At Sherlock, our bug bounty service is designed to provide Superfluid with ongoing, proactive protection by leveraging a global network of over 10,000 security researchers, including our elite Blackthorn auditors.
Unlike other bug bounty programs, that require a huge time commitment from the team, Sherlock has designed this program with some unique features to make it simple, straightforward, and easy for the team to manage.
Here’s how it works, why it stands out, and how it’s uniquely positioned to elevate Superfluid’s long-term security.
How it Works
Our post-launch bug bounty program is a continuous security solution tailored to Superfluid’s needs, running alongside your development lifecycle. After our past audit of your protocol, we’re excited to take the next step by designing and hosting a bug bounty program with these key features:
- Expert Triaging: Unlike other platforms, where a critical bug submission might leave you waiting weeks to confirm its validity, Sherlock’s expertise allows us to triage issues immediately. With our prior audit of Superfluid, and our proprietary dataset on thousands of security researchers, we know your codebase and can tap the exact researchers who understand it best to validate submissions fast, delivering detailed feedback on validity and potential fixes.
- Spam Reduction: Every submission requires a $250 deposit from researchers, which filters out low-quality reports. That deposit funds our auditors to jump in, triage the issue, and provide actionable insights - ensuring you’re not bogged down by noise.
- Maximum Visibility: Unlike platforms hosting hundreds of programs, Sherlock offers Superfluid standout exposure. A $200k critical payout would land Superfluid on the first page of our hosted bounties, and with 10,000+ researchers already signed up, we’ll promote your program directly to them - getting massive eyes on your code from day one. Plus, we can amplify this with co-marketing and promotional activities.
- Simplicity and Ease of Use: Our proprietary dashboard makes managing the program effortless—Superfluid’s team can add or change the covered scope with just a few clicks. We’ve designed it this way to minimize the time commitment required, so your team can focus on building rather than maintaining the program.
- Flexible Scope and Rewards: We collaborate with Superfluid to define the in-scope contracts (e.g., core streaming logic, token integrations) and set payout tiers based on vulnerability severity - Critical, High, Medium, or Low. Rewards can range up to $100,000’s for critical bugs, ensuring serious issues get serious attention.
- Transparent Reporting: Every valid submission is documented and shared (with your approval), giving delegates and the community full visibility into resolved threats and reinforcing trust in the protocol.
Design
Sherlock will work closely with Superfluid to design a custom program tailored to Superfluid’s specific needs. Through a collaborative process, we’ll define the scope of the program, severity classifications (Critical, High, Medium, Low) and clear rules that align with Superfluid’s goals. Our proprietary dashboard makes this effortless: with just a few clicks, the team can adjust the scope or rules as needed, ensuring flexibility as your protocol evolves.
Timeline
Setting up a bug bounty program with Sherlock is fast and straightforward - it can be fully operational in a single day. We’re ready to adapt to your schedule and can begin whenever Superfluid is prepared to take this step. Whether you want to launch immediately or plan for a specific date, our team is flexible and equipped to get the program up and running quickly, providing instant access to our global network of security researchers and ensuring your protocol benefits from enhanced protection right away.
Audit Contest
Sherlock’s audit contests are distinguished by their quality and comprehensive nature. Our proprietary “best of both worlds” approach combines the focus, collaboration, and assurance of a traditional audit with the extensive participation of security experts from an audit contest. This method has proven significantly more effective in identifying vulnerabilities quickly and thoroughly compared to traditional audits.
Our unique leaderboard system, based on performance rather than participation, ensures only the most skilled auditors rise to the top. Using an ELO-style ranking system (commonly used in chess and other competitive sports), auditors must consistently outperform their peers to advance. This system incentivizes maximum effort and results in exceptional audit outcomes.
Each Sherlock contest includes at least one Lead Senior Watson (a professional security researcher in the Top 30 on the leaderboard) and multiple Watsons from the Top 150, selected based on their leaderboard position and relevant experience with similar protocols. This ensures that every contest has expert auditors reviewing the codebase, consulting with the protocol team, and conducting a complimentary half-day fix review. The Lead Senior Watson earns fixed pay and competes for the entire prize pool, further aligning incentives.
The talents of this one individual are enhanced by competing against an unlimited number of independent security experts / teams striving to win a greater portion of the prize pool. The Senior Watson only keeps their “senior” status as long as they outperform the other auditors in the field, pushing them to give maximum effort.
Benefits of Sherlock Audit Contests
- Each contest has an assigned Lead Senior Watson who is heavily incentivized (through fixed pay and an ELO-style ranking system 2) to find as many bugs as possible over the entire length of the audit.
- A significant contest prize pool attracts anywhere from 200-400 independent auditors who get paid based on the severity of their findings. Sherlock specifically rewards only High and Medium severity threats.
- The Lead Senior Watson comes back to help the protocol team with fixes (provides a half-day complimentary fix review).
- Sherlock’s decentralized judging process takes hundreds of raw, duplicate issues and turns them into a digestible report, saving the protocol team days of work and reducing the possibility of overlooked vulnerabilities.
- Sherlock charges the lowest fees in the industry. 80% of what you pay to Sherlock goes directly to security experts.
- Sherlock is the only auditor to offer exploit and/or bug bounty coverage after the audit is conducted (once the fix review is finished), ensuring that Sherlock’s incentives are aligned in shipping the most secure protocol possible.
How Superfluid Benefits
Partnering with Sherlock would bring tangible advantages to Superfluid:
- Enhanced Security : A thorough audit will harden your core smart contracts against exploits, while an ongoing bug bounty program ensures long-term resilience as new features roll out.
- Increased Trust : Publicly verifiable audit reports and a robust bounty program signal to users and developers that Superfluid prioritizes security, boosting adoption and confidence.
- Cost Efficiency : By catching vulnerabilities early through audits and incentivizing white-hats, we minimize the risk of costly hacks - protecting both funds and reputation.
Next Steps
We’d love to kick things off with a discussion to scope an initial audit of Superfluid’s smart contracts and design a bug bounty program that complements your existing efforts.
Thank you - we’re eager to hear your feedback and answer any questions.
