Pre-ERC: Agent Pre-Sign Risk Report

What it claims

The draft defines what a pre-sign risk source says, which the Prepared Transaction Envelope proposal (ERC-8265 thread) leaves open. That envelope has a risk slot with an action (ALLOW / WARN / BLOCK), an optional score, free-form warnings and scanner verdicts. A consumer receiving only WARN cannot see what was read, cannot apply its own thresholds, and cannot tell "found nothing" from "couldn't read it". The author targets five common agent losses, all visible before signing:

• unlimited approvals to plain wallets or week-old contracts
• transfers to lookalike addresses that share first and last characters with a prior counterparty
• buys of copied tokens or through pools priced far from their oracle
• x402 payments to a payTo that is not the payee's registered wallet
• instructions hidden in token names

On Robinhood Chain, the page counts 3,148 copies of Robinhood's own stock tokens.

How it works

The report's digest uses the same pre-image as the envelope's coverage, so writing the report into the risk slot does not change the digest. After verifying the EIP-712 signature, the consumer checks that the signer is the ERC-8004 identity's agentWallet or owner. The finding groups record these fields:

• Tokens: launch facts from a Launch Observations registry (ERC-8470), copies of an issuer's listed token, and pool deviation from a price feed.
• Approvals: amount, unlimited flag, share of supply, expiry and current allowance.
• Addresses: code type (none, contract or 7702-delegated), first seen, verified source, prior transfers and lookalikes.
• Payments: x402 payTo checked against the payee's registered agentWallet, with x402 Payee Verification (ERC-8478) outcomes.
• Texts: control characters, mixed scripts, embedded addresses and instruction patterns in text the agent read.

Each finding states the block height it holds at and its evidence. "Not read" is never encoded as zero or false. A consumer MAY project findings into the envelope's warnings. The draft is the third piece of a stack with ERC-8470 and ERC-8478.

How to use it

The reference service is toll, ERC-8004 agent #20030, live on Robinhood Chain. It accepts three inputs: a prepared transaction, an EIP-712 request or an x402 requirement. It returns ALLOW / WARN / BLOCK with typed reasons, free over HTTP and MCP. Note that the service returns a verdict, while the draft format itself carries none.

A one-line client, @tollxyz/guard, puts the check in front of a viem or ethers wallet. Cases it blocks today:

• an unlimited approval to a plain wallet
• a copy of an official stock token
• an x402 payTo that is not the seller's wallet

The page gives no endpoint URLs, schemas or install commands.

Limits

This is a pre-ERC with three open questions:

• Should reports sit inside the envelope's risk slot or in a separate consumer-written field?
• Should v1 use a fixed list of finding kinds, or open namespaced kinds like Launch Observations?
• Should signed reports be anchorable on chain as a hash in a registry, or is off-chain EIP-712 enough?

The format depends on drafts that are also unfinalized: ERC-8265, ERC-8470 and ERC-8478. The only stated deployment is Robinhood Chain.