Audits and insurance are not an either/or choice. They are risk defense tools on different levels and cannot substitute for each other. Audits answer the question "Is the code written correctly?" while insurance addresses "Is the logic itself flawed even if the code is correct, or did the environment change after deployment?" Their coverage scopes are completely different.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
What Audits Can and Cannot Do
The essence of an audit is static analysis of contract code: checking for overflow vulnerabilities, permission loopholes, reentrancy attacks, and other known issues. However, it has three systemic blind spots:
State explosion problem: When formal verification tools encounter complex external interaction paths, they are limited by computational resources and can only explore a finite number of paths. Vulnerabilities may exist in paths not covered by the tool, and auditors similarly cannot exhaust all state combinations.
Specification gap: Audits can only verify whether "the code executes according to the specification," not whether "the specification itself is economically sound." In the Balancer V2 vulnerability at the end of 2025, the protocol had undergone 11 audits, but the flaw was a precision error in mathematical operations—the code fully followed the specification, but the specification itself was wrong.
Upgradability paradox: An audit is a snapshot of the code at a specific point in time. After a protocol upgrade, the old audit report becomes invalid, and proxy contract upgrades may introduce storage collision risks that current tools cannot fully cover.
What Insurance Can and Cannot Do
Insurance covers what audits cannot—primarily runtime risks after code deployment. According to DeFiLlama data, since 2020, uninsured lending protocols have suffered cumulative losses of approximately $7.7 billion from attacks, with over $600 million in losses in April 2026 alone.
The core value of insurance is: even if an audit finds no issues, the money in the pool can compensate users after an attack occurs. But insurance has its own limitations:
Extremely low coverage: Nexus Mutual is the largest DeFi insurance protocol, with a TVL of about $123.5 million, accounting for only 0.14% of total DeFi TVL (around $83 billion). Less than 2% of DeFi assets have insurance coverage.
Attack surface has shifted: Early DeFi insurance primarily priced smart contract vulnerability risk. Now most major losses come from private key theft, phishing, social engineering, and cross-chain bridge logic flaws—these are difficult for insurance underwriters to price, and some are not even within the coverage scope.
Circular risk in insurance pools: Several early insurance protocols failed or were attacked between 2021 and 2024 due to unsustainable token economics, conflicts of interest, and other issues. The capital in insurance pools is often exposed to the same type of vulnerabilities they are supposed to hedge against.
Combining Both Forms a Complete Defense System
Audits are pre-incident prevention; insurance is post-incident compensation. Audits cannot predict complex interactions among external oracles, liquidity shifts, and upgrade dependencies in an adversarial environment; insurance can handle these "runtime anomalies that audits cannot cover." The two are orthogonal layers of defense-in-depth, essential together.
Sherlock's model bundles audit and insurance—first auditing, then providing insurance for protocols that pass the audit, with the audit team bearing financial risk for audit quality. But even this model has systemic issues: audit blind spots may affect multiple insured protocols simultaneously, leading to a single correlative attack draining the insurance pool. Sherlock's C+ rating reflects this structural risk.
Common Reasons for Failure
Many people treat an audit report as a "security certification," believing that an audited protocol won't have problems, and then use insurance to cover all their assets. But an audit is a static snapshot, code gets upgraded, and attack methods evolve—about 30% of code vulnerabilities in audited protocols still occur after the audit, and the insurance pool itself may be insufficient to handle extreme systemic risks.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Next Steps
If you plan to participate in a DeFi protocol, first check the date of its most recent audit report and the scope (whether it covers the currently running version). Then check the protocol's Available Capacity and premium rate on Nexus Mutual or Sherlock. If the coverage limit is lower than your position, either supplement with other insurance or reduce your position. The audit determines "whether you should trust the code," while insurance determines "what happens if the code fails." The two need to be evaluated separately.
