ERC-8481: Agent Pre-Sign Risk Report

What it claims

ERC-8481 defines what a risk source says about one prepared, unsigned agent request. It fills a gap in the Prepared Transaction Envelope proposal (ERC-8265 thread). That proposal gives the consumer a risk slot with an action (ALLOW / WARN / BLOCK), an optional score, free-form warnings and scanner verdicts. It does not define the content behind them. The author argues that, as a result, a consumer receiving WARN cannot see what was read, cannot apply its own thresholds, and cannot tell "found nothing" from "couldn't read it". The draft targets losses the author calls visible before signing:

• an unlimited approval to a plain wallet or a week-old contract
• a transfer to an address that matches a prior counterparty's first and last characters
• a buy of a copycat token or through a pool priced far from its oracle (Robinhood Chain has 3,148 copies of Robinhood's own stock tokens)
• an x402 payTo that is not the paid agent's registered wallet
• an instruction hidden in a token name

How it works

For an envelope, the report's digest uses the same pre-image as the envelope's coverage. Writing the report into the risk slot therefore does not change the digest. The consumer must recheck that the EIP-712 signer is the ERC-8004 identity's agentWallet or owner.

Each finding records the block it holds at and its evidence. Token findings read launch facts from a Launch Observations registry (ERC-8470). Address findings distinguish no code, contract, and 7702-delegated code, and add first-seen, verified source, prior transfers and lookalikes. Payment findings use the outcomes of x402 Payee Verification (ERC-8478). Text findings flag control characters, mixed scripts, embedded addresses and instruction patterns. A "not read" finding is never encoded as zero or false. Consumers MAY project findings into the envelope's warnings.

flowchart LR
  A[ERC-8470 Launch Observations] --> R[ERC-8481 report]
  B[ERC-8478 Payee Verification] --> R
  C[Chain reads + request] --> R
  R --> E[ERC-8265 envelope risk slot]
  R --> P{Consumer's own policy}
  P -->|allow| S[Sign]
  P -->|warn/block| X[Stop or ask]

How to use it

toll, ERC-8004 agent #20030, is the live implementation on Robinhood Chain. It accepts a prepared transaction, an EIP-712 request or an x402 requirement over HTTP or MCP, free of charge. Unlike the standard, it returns its own ALLOW / WARN / BLOCK verdict with typed reasons. The client package @tollxyz/guard wraps a viem or ethers wallet in one line. The page gives no install command or endpoint URL.

Limits

This is a draft, and three design questions are open in the thread:

• whether reports sit inside the envelope's risk slot or in a separate consumer-written field
• whether finding kinds stay a fixed v1 list or become open and namespaced
• whether signed reports should be anchorable on chain or remain off-chain EIP-712 only

The finding schema depends on two other draft ERCs, 8470 and 8478. The page gives no detection rates, false-positive figures or latency for toll. Its only deployment is on Robinhood Chain.