paythos.co

What It Is

Paythos positions itself as “Evidence-gated CI security for smart contracts.” Rather than producing traditional static scan reports, it runs on every commit/PR, generates vulnerability hypotheses, writes and executes Foundry tests, and ultimately returns a Pass / Warn / Block status check. Its emphasis is on “reproducible evidence”: generated test code, execution logs, commands, and versions, so developers can rerun and verify the security conclusions themselves.

Core Capabilities

Based on the main description, Paythos focuses on security regression protection for smart contracts: weakened access control, external calls introducing reentrancy windows, upgrades breaking storage layout, accounting logic drifting under edge cases, and similar issues. Its workflow includes attack-surface reconnaissance, vulnerability hypothesis generation, test construction, execution and review, supporting evidence, and learnings. For management and alerting, the Pass/Warn/Block signals are well suited to merge gates: Warn means the result is uncertain and needs human review, while Block means the hypothesis has been validated and is reproducible.

Deployment, Integration, and Pricing

The text clearly states that Paythos runs in CI and uses Foundry/forge test to generate and execute tests, making it suitable for teams that already have a smart contract CI process. However, it does not disclose support for specific platforms such as GitHub Actions or GitLab CI, nor does it clarify whether the product is SaaS, self-hosted, or hybrid. On pricing, only a 7-day proof pilot is mentioned, with a refund promise if it cannot run and produce a verdict. Official pricing, billing model, and payment methods are not publicly disclosed.

Pros and Cons

The main advantage is that results are centered around the diff, avoiding the noise of generic scan reports. It also turns findings into runnable tests, making it easier to close the loop in an engineering workflow. It covers high-value scenarios such as access control, reentrancy, upgrade safety, oracles, accounting invariants, and token interactions. The limitation is insufficient disclosure: compliance certifications, data handling, security boundaries, support SLA, and pricing are all missing. It also cannot replace human audits, especially when dealing with Warn results or complex economic attacks that still require expert judgment.

Who It’s For and Access from China

Paythos is best suited for teams that are highly sensitive to PR-level security regressions, such as DeFi projects, protocol developers, and on-chain asset custody teams—especially engineering organizations already using Foundry. There is no basis in the text to determine accessibility from China, so it should be marked as unknown; network access, payment, and contract procurement may need to be verified in practice. Alternative or complementary options include Slither, Echidna, Mythril, Certora, Foundry fuzz/invariant testing, and manual smart contract audits.