ERC-8481: Agent Pre-Sign Risk Report

What it is

ERC-8481 is a draft standard on Ethereum Magicians for the report a risk source returns about one prepared, unsigned request. It targets AI agents that sign transactions with no person reading each one. It fills a gap in the Prepared Transaction Envelope proposal (ERC-8265). That proposal gives a consumer a risk slot holding ALLOW / WARN / BLOCK, an optional score, free-form warnings and scanner verdicts, but does not define what a risk source says. A consumer that gets WARN cannot see what was read, cannot apply its own thresholds, and cannot tell "found nothing" from "couldn't read it".

How it works

The report binds to the request by a digest. For an envelope, this is the same pre-image its coverage uses, so writing the report into the risk slot does not change it. The source is named by an ERC-8004 identity and signs with EIP-712. The consumer checks that the signer is that identity's agentWallet or owner.

Findings fall into five groups:

• tokens: launch facts read from a Launch Observations registry (ERC-8470), a token that copies an issuer's listed token, and a pool's deviation from a price feed.
• approvals: amount, unlimited, share of supply, expiry, current allowance.
• addresses: code (none, contract or 7702-delegated), first seen, verified source, prior transfers, lookalikes.
• payments: x402 payTo checked against the payee's registered agentWallet, with the outcomes of x402 Payee Verification (ERC-8478).
• texts: control characters, mixed scripts, addresses and instruction patterns in text the agent read.

Every finding states the block it holds at and its evidence, and is marked read or not read. Not read is never reported as zero or false. There is no score, verdict or recommended action. The consumer applies its own policy and may project findings into the envelope's warnings.

Preconditions / Affected

The page motivates the design with five failures: an unlimited approval to a plain wallet or week-old contract, a transfer to a lookalike address sharing first and last characters with a prior one, a buy of a copied token (3,148 copies of Robinhood's stock tokens exist on Robinhood Chain) or through a pool priced far from its oracle, an x402 payTo that is not the paid agent's registered wallet, and an instruction hidden in a token name.

What to do

The only implementation is toll (ERC-8004 agent #20030), a live pre-sign check on Robinhood Chain. It accepts a prepared tx, an EIP-712 request or an x402 requirement, and returns ALLOW / WARN / BLOCK with typed reasons. It is free over HTTP and MCP. The client @tollxyz/guard wraps a viem or ethers wallet.

Caveats

The draft has three open questions:

• Should reports be a member of the envelope's risk slot, or a separate consumer-written field?
• Should the list of finding kinds be fixed for v1, or open and namespaced like Launch Observations?
• Should a signed report be anchorable on chain through a hash in a registry, or is off-chain EIP-712 enough?