Skip to content

Phylax

$PHYLAX

AI Agents

Contract 0xff36bcb3cb9e3e2dac718ccaec3bc5ed489d9f0d

HEY holds 21 other Robinhood Chain tokens that use $PHYLAX. This page is only the contract above. See them

Is this your project? Claim and verify →

Phylax is a pre-install security layer for AI agent skills. Before a skill can touch a wallet, Phylax scans it and returns a deterministic verdict — ALLOW, WARN, or DENY — with a rule ID and human-readable proof for every finding. It turns "install and hope" into "audit, then install."

Read more

What HEY knows

Building
Dormant: no ship for 98 daysDormant: 0 meaningful events in 30 days; latest ship on 2026-07-12. Evidence Source

Build Momentum 0How it is measured

Latest ship
Code changes, week of 2026-07-06 – 2026-07-12 · at least 15 commits · · Code activity

Why it matters: First week of code changes after 20 quiet days.

Latest change
DerivedMarket event 5 days ago: Liquidity $7K → $12K in a week. Context, not building. Evidence

Follow puts Phylax on your private watchlist; its changes then lead “Since you were last here” when you come back. Following needs an account; browsing never does.

No account? Email me Phylax’s changes

No account and no password. HEY stores the address and what you asked for, sends one confirmation, and nothing else until you confirm. Every email has a one-click unsubscribe that deletes the address.

Or read its RSS feed.

Product usage
FactNo calls to its 1 watched contract in 7 days.

Counted from the chain. Usage says the contracts are used, not that anyone is building.

Contracts
Fact1 contract on record for code changes, 1 with verified source; no implementation or interface change recorded.
Token market · context
Trading inactiveToken verified
Not yet known
Unknown3 gaps: Official docs (no source), API description (no source), Contract activity (partly measured). HEY read its website and found no link to docs.

HEY can answer 17 of the 20 research questions that apply · Research coverage

Compare with…The same summary, with every line’s evidence: snapshot API
What HEY checked — why it says this
Dormant.
“Dormant” by the activity rule: 0 meaningful events in the last 30 days, the newest 2026-07-12.
SourceRepositories, changelogs and feeds HEY reads for this project, and the ship events recorded from them.ReadRecordsCode changes, week of 2026-07-06 – 2026-07-12 · at least 15 commitsv0.1.0 — Phylax public launchWhat HEY derivedHEY’s activity rule reads the counted events as “Dormant”.Not concludedIt says what HEY can read of the building, not how good the project is, who is behind it, or what its token will do. Quiet or unknown is not "abandoned".
Verified Builder.
The quality gate found verified building evidence from the project's own sources.
Source4 registered sources, 0 of them context only.ReadRecordsCode changes, week of 2026-07-06 – 2026-07-12 · at least 15 commitsv0.1.0 — Phylax public launchsource:f8ab8c9a-9d87-4292-a7a2-8f3d2fa50484+3 moreWhat HEY derivedThe quality gate’s stored decision: “Verified Builder”.Not concludedA verified builder is one whose shipping HEY confirmed from public evidence. It does not say who runs the project — that is the ownership claim, a separate check.
Token verified.
Token verified: the project's own site, a deploy record in its own repository, or an on-chain signature names this contract.
SourceThe project's own published sources and HEY's check of the contract.ReadWhat HEY derivedToken verified: the project’s own site names it.Not concludedIt says whether the project itself names this contract. It is not a safety check, and a token is not the project.
Trading inactive.
Trading inactive: the only pool is the launch pool holding the token’s own supply, and nothing traded in it in the last day.
Source4 readings from HEY's own market tables.ReadWhat HEY derivedHEY’s market rule reads this token’s market as “Trading inactive”.Not concludedMarket status is context only. It never changes activity status or Build Momentum, and it is not a view on the price.
Market figures are context only and never change activity status. Methodology

Latest ship

Checked

Code changes, week of 2026-07-06 – 2026-07-12 · at least 15 commits

Code activitySource linked

1 active day in usephylax/phylax-skill-audit.

This week HEY looked inside 1 of 15 commits to see what changed: 1 changed code. One code change is enough for the week to count, so HEY stopped there.

Record ship:ae8a62e4… · HEY counts it as building; it does not judge the release’s quality or what it means for the token.

Builder activity

No meaningful, source-backed updates in the 7 weeks since HEY began reading this project’s sources; earlier weeks are not yet read.

Questions HEY can answer about Phylax — as of 2026-10-18

Is Phylax still being built?
DerivedDormant: 0 meaningful events in 30 days; latest ship on 2026-07-12. Evidence
What did Phylax ship last?
FactCode changes, week of 2026-07-06 – 2026-07-12 · at least 15 commits — Code activity, on 2026-07-12. Evidence
Is 0xff36bcB3cB9e3e2dac718ccaec3Bc5Ed489D9f0d Phylax’s own contract?
FactToken verified: The project’s own site names this contract. Details
What does HEY not know about Phylax?
Unknown3 gaps: Official docs (no source), API description (no source), Contract activity (partly measured). HEY read its website and found no link to docs. Details

Build timeline

  1. v0.1.0 — Phylax public launch

    GitHub releaseSource verified

    First public release of Phylax — a pre-install security audit for agent skills on Base (chain 8453). Phylax scans a skill before you install it and returns a deterministic ALLOW / WARN / DENY verdict with line-level evidence. What it does · Static scan — prompt-injection… Show all
    • First public release of Phylax — a pre-install security audit for agent skills on Base (chain 8453). Phylax scans a skill before you install it and returns a deterministic ALLOW / WARN / DENY verdict with line-level evidence. What it does
    • Static scan — prompt-injection, secret-exfiltration, and obfuscation in SKILL.md + manifest
    • Onchain scan — referenced Base contracts: bytecode selectors, proxy/upgradeability, honeypot/owner powers
    • Endpoint scan — x402 endpoints: HTTPS enforcement, 402 schema, price sanity
    • Deterministic scoring — score = 100 −…

Research notes

Written by HEY researchers and reviewed before publishing. Commentary with sources — not the project's own claims, and not evidence of shipping.

Know something about Phylax? Sign in with GitHub to submit a research note. Notes are reviewed before they appear here.

What changed

9 changes on HEY’s record for Phylax: 1 release · 1 market check · 6 market moves · 1 week of code pushed.

All 9 changes for Phylax →

The full change record holds 2 more, of kinds this list leaves out — lock records and HEY’s own research bookkeeping among them. Full record (JSON)

Research coverage

HEY can answer 17 of the 20 research questions that apply.

17 of 20 applicable dimensions measuredShow each dimension

Identity

  • IdentityMeasuredRead 1mo ago.

Building

  • Building activityMeasuredRead 2d ago.
  • RepositoriesMeasured
  • ReleasesMeasuredRead 3mo ago.
  • TimelineMeasured

Official site

  • Official docsNo sourceHEY read its website and found no link to docs.
  • API descriptionNo sourceIts website links no API description.
  • Official site changesMeasuredRead 14h ago.

Code and packages

  • Repository detailsMeasuredRead 1h ago.
  • Published packagesMeasuredRead 26m ago.
  • Package advisoriesMeasuredRead 1h ago.

Contracts

  • Contract creationMeasuredRead 1h ago.
  • Contract activityPartly measuredSome days’ events were decoded; on others only the calls could be read.
  • Verified sourceMeasuredRead 3d ago.
  • Contract interfaceMeasuredRead 3d ago.

Market

  • Current marketMeasuredRead 23m ago.
  • Market historyMeasuredRead yesterday.
  • Supply distributionMeasuredRead 9d ago.
  • LocksMeasuredRead 2h ago.
  • Market checksMeasured

Not applicable here: Protocol economics.

A count of what HEY has read, never a score: projects are not compared or ordered by it. Unknown is never zero. The same states: coverage API.

Sources

Security context: 1 audit report found. An audit shows an audit took place; it is not a guarantee of safety.

Contract
0xff36…9f0d0xff36bcb3cb9e3e2dac718ccaec3bc5ed489d9f0d