Pre-ERC: Agent Pre-Sign Risk Report

What it is

A draft ERC on Ethereum Magicians that defines what a risk source says about one unsigned request. The Prepared Transaction Envelope proposal (ERC-8265 thread) already has a risk slot with an action (ALLOW / WARN / BLOCK), an optional score, free-form warnings and scanner verdicts. It does not define their content. A consumer that gets WARN cannot see what was read, cannot apply its own thresholds, and cannot tell "found nothing" from "couldn't read it". This draft fills that gap. It is the third piece of a stack with Launch Observations (ERC-8470) and x402 Payee Verification (ERC-8478).

How it works

The report binds to the exact request by a digest. For an envelope, this is the same pre-image its coverage uses, so writing the report into risk does not change the digest. The source is named by an ERC-8004 identity and signs with EIP-712. The consumer checks that the signer is that identity's agentWallet or owner.

Findings fall into five groups:

• tokens: launch facts from a Launch Observations registry, copies of an issuer's listed token, and a pool's deviation from a price feed.
• approvals: amount, unlimited, share of supply, expiry and current allowance.
• addresses: code (none, contract or 7702-delegated), first seen, verified source, prior transfers and lookalikes.
• payments: x402 payTo checked against the payee's registered agentWallet, with the ERC-8478 outcomes.
• texts: control characters, mixed scripts, addresses and instruction patterns in text the agent read.

Every finding states the block it holds at and its evidence. Each is marked read or not read, and not read is never to be treated as zero or false. There is no score, verdict or recommended action. The consumer applies its own policy and may project findings into the envelope's warnings.

Reference implementation

Toll (ERC-8004 agent #20030) runs on Robinhood Chain. It accepts a prepared tx, an EIP-712 request or an x402 requirement, and returns ALLOW / WARN / BLOCK with typed reasons. It is free over HTTP and MCP. The @tollxyz/guard client wraps a viem or ethers wallet. The post says it blocks an unlimited approval to a plain wallet, a copy of an official stock token, and an x402 payTo that is not the seller's wallet. It cites 3,148 copies of Robinhood's own stock tokens on that chain. Note that toll returns a verdict, while the draft format itself carries none.

Open questions the author asks

• Should reports be a member of the envelope's risk slot, or a separate consumer-written field?
• Should v1 use a fixed list of finding kinds, or open namespaced kinds as in Launch Observations?
• Should a signed report be anchorable on chain by a hash in a registry, or is off-chain EIP-712 enough?

Caveats

This is a pre-ERC draft with no number or specification text beyond the outline. The page gives no field names, schema or digest construction. Its claims about toll's blocking are the author's own and are not independently shown.