It's a pretty good bet that Akash is asking about go.sum. Akash, the go.sum is not actually a "lock file" (like many other languages' package managers have). Just go.mod is enough to determine the exact versions of all the modules, as you indicate. What go.sum contains are cryptographic hashes of all the module contents, allowing the Go tooling to verify that what it downloads are the same bytes the package author downloaded. Often other languages store these hashes in their lock files, but Go Modules does things a bit differently.
-Ben