Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem

T0 review · 3 major / 6 minor · reviewed 2026-07-12 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read As deployed, ERC-8004’s reputation layer cannot serve as a trust signal: most registered agents are placeholders, scores are incommensurable and cheap to fake, and Sybil reviewers dominate the market.

desk verdict First real multi-chain measurement of ERC-8004: the identity layer is mostly placeholders and the reputation registry is structurally unusable as a trust signal; the Sybil numbers are the softest part but the design critique stands without them. read the letter →

arxiv 2606.26028 v2 pith:SMFBYZKT submitted 2026-06-24 cs.CR cs.AIcs.MA

Xihan Xiong , Zelin Li , Wei Wei , Qin Wang , William Knottenbelt , Zhipeng Wang This is my paper · ORCID
classification cs.CRcs.AIcs.MA
keywords AIagentsblockchainERC-8004trustlessreputationsystemsSybilattackagenteconomy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is the first multi-chain empirical study of ERC-8004, the permissionless on-chain trust layer intended to let autonomous AI agents decide whether unknown counterparts are trustworthy. Across Ethereum, BSC, and Base from launch through mid-May 2026, the authors crawl every Identity and Reputation event, the linked off-chain files, and related x402 payments. They show that registration volume is dominated by placeholders: only 3 percent, 4 percent, and 15 percent of agents expose a valid registration file with a live service endpoint. On the reputation side the registry fails four necessary conditions for a usable trust score—shared scale, robustness to outliers, grounding in real interaction, and costly manipulation—and the data confirm the failure: 59–91 percent of reviewers exhibit coordinated Sybil funding patterns, after whose removal most rated agents retain no valid feedback. The authors convert each finding into concrete redesign recommendations so that future agent markets can actually rely on the recorded signals.

What carries the argument

The four necessary conditions a reputation score must satisfy to be a trust signal—C1 commensurability of values, C2 robustness (nonzero breakdown point), C3 groundedness in verifiable interaction, C4 economic soundness—together with the on-chain arithmetic-mean aggregator and the shared-first-funder funding-graph detector used to measure real-world Sybil campaigns.

What would settle it

An independent re-analysis of the same funding graphs that, after excluding known legitimate batch operators and infrastructure addresses, recovers Sybil-flagged reviewer fractions below ~20 percent and leaves the majority of rated agents with intact non-Sybil feedback would overturn the market-damage numbers and the claim that the registry cannot serve as a trust signal.

Watch

Extended reading notes

Core claim

The ERC-8004 Reputation Registry, as currently deployed, cannot function as a trust signal for autonomous agents. Feedback values are not commensurable across tags or chains, almost never carry proof of a real interaction, can be moved by a single extreme or ceiling-valued rating, and cost only cents to fabricate or destroy; empirically, Sybil-flagged reviewers comprise 59–91 percent of the reviewer population and, once removed, leave 15–89 percent of rated agents with no remaining valid feedback.

Load-bearing premise

That shared first-funder provenance in the native-token funding graph is a reliable detector of coordinated Sybil campaigns rather than legitimate multi-wallet operators or shared infrastructure.

Editorial extensions

If this is right

  • Protocol designers must type the value field (unit, range, direction) and define a canonical overall-rating tag before consumers can safely aggregate scores.
  • Feedback must be bound to a verifiable interaction (settled x402 payment or Validation Registry attestation) or at least surface evidence-backed versus unbacked counts by default.
  • On-chain aggregation must switch from plain mean to a robust bounded-influence rule (median or trimmed mean, per-reviewer caps, evidence weighting).
  • The cost of changing a score must scale with the value that score controls (stake-and-slash or payment-volume weighting) so gas-only Sybil attacks become uneconomic.
  • Cross-chain reputation portability should follow, not precede, strong per-chain integrity and verifiable identity binding; otherwise manipulation simply propagates.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Open agent registries that treat raw registration and feedback counts as maturity metrics will systematically overstate ecosystem health until a canonical liveness predicate and evidence requirements are enforced by default.
  • Any permissionless reputation layer that leaves semantics, aggregation, and Sybil resistance entirely to off-chain consumers that have not yet emerged is likely to exhibit the same incommensurability and cheap-manipulation failures.
  • Once Validation Registries ship, a direct empirical test will be whether evidence-backed feedback measurably reduces Sybil dominance and restores a usable reputation baseline.
  • Agent payment rails such as x402 remain vulnerable to free-riding and misattribution until payment proofs become mandatory inputs to reputation rather than optional off-chain decorations.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper presents the first multi-chain empirical study of ERC-8004 (Identity and Reputation Registries) on Ethereum, BSC, and Base from deployment through 13 May 2026. Using on-chain events, off-chain registration/feedback files, gas costs, and x402 settlements, the authors show that most registered identities are placeholders (only 3–15% expose a valid registration file with a live service endpoint) and that the Reputation Registry, as deployed, fails four necessary conditions for a trust signal: values are incommensurable (C1), the mean aggregator has breakdown point zero (C2), feedback is rarely grounded in verifiable interactions (C3), and manipulation costs only cents (C4). Empirically, a shared-first-funder detector flags 59–91% of reviewers as coordinated Sybils; after removal, 15–89% of rated agents retain no valid feedback. The paper closes with concrete protocol-design recommendations.

Significance. If the measurements hold, this is an important early baseline for AI-agent market infrastructure: it shows that raw registration and feedback volume are poor maturity proxies, and that a deliberately thin on-chain reputation layer does not by itself yield a usable trust signal. Strengths include careful event-replay and off-chain file methodology, cost arguments that follow directly from the contract interface, multi-chain coverage, and actionable recommendations (typed tags, robust aggregation, evidence-backed feedback, influence costs, default Sybil defenses). The design critique (C1–C4) is largely independent of any detector and is of lasting value for ERC-8004 and similar registries. The work establishes a reproducible empirical baseline for a rapidly growing but previously unstudied protocol.

major comments (3)
  1. [§7.6, Table 7] §7.6 and Table 7: The market-damage claim (15.5/72.3/89.4% of rated agents left with no valid feedback after Sybil removal; abstract variants 15.8/77.9/86.8%) rests on a shared-first-funder funding-graph heuristic. Legitimate multi-wallet operators, shared gas infrastructure, or coincidental funding trees can produce the same signature. Appendix E’s behavioral signals (queue-sweep, template concentration) strengthen the case for some clusters but do not measure false-positive rate or provide a sensitivity analysis under alternative clustering rules. Because these percentages are featured in the abstract and framed as evidence that manipulation is already happening at scale, the paper should either (i) report precision/recall bounds or alternative detectors, (ii) recompute Table 7 under stricter/looser rules and show robustness, or (iii) clearly demote the post-removal percentages to an u
  2. [Abstract, §1, Table 7] Abstract vs. body numerical inconsistency: reviewer Sybil shares are given as 73.5/59.2/90.6% in the abstract and 73.6/59.2/90.6% in the body; no-baseline agent shares are 15.8/77.9/86.8% in the abstract vs. 15.5/72.3/89.4% in Table 7 and the introduction. These are load-bearing headline numbers. Please reconcile all abstract, introduction, and Table 7 figures from a single frozen computation and state the exact filter (non-revoked scored feedback only, etc.).
  3. [§7.3, Figures 15–16] §7.3–7.5, free parameters: The flip analysis uses τ=90 and a [0,100] rating-style tag filter; off-scale values use ˜v∉[0,100]. Figures 15–16 show some τ sensitivity for flippability, but the paper does not report how median attack cost or the fraction of agents with k≤5 change under alternative ceilings or tag filters. A short sensitivity table would make C2/C4 less dependent on the chosen thresholds and strengthen the claim that no safe threshold exists.
minor comments (6)
  1. [§5.4] §5.4 / Figure 8: The compliance criterion (exact match to the canonical type URI) is strict and well-defined; consider a one-sentence note on how many near-miss files (e.g., wrong version string) exist, so readers can judge whether non-compliance is mostly empty/placeholder vs. minor schema drift.
  2. [§6.1, Figure 10] §6.1 / Figure 10: Clarify whether normalized value uses value/10^decimals consistently for all chains and whether revoked feedback is excluded from the histograms.
  3. [§7.4] §7.4 / Figure 18: The reviewer-level x402 test is correctly framed as conservative; a brief forward pointer in the main text to Appendix C.4’s formal implication (H(c)=0 ⇒ P(c,a,b)=0) would help readers who skip the appendix.
  4. [Table 2] Table 2: BSC batch agent % is reported as 0.0 despite 22 batch agents; use a more precise percentage or “<0.1%” for readability.
  5. [§4 and passim] Throughout: occasional typographic inconsistencies (e.g., “reputaion” in §4 heading; spacing in “73 .6%”, “15 .5%”) should be cleaned in copy-edit.
  6. [§9] §9: The limitation that Validation Registry had no mainnet deployment is clear; if any testnet or pending deployment addresses are public, a footnote would help future replication.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: observational measurement study whose quantities are computed from on-chain events and protocol rules, not fitted inputs re-derived as predictions.

full rationale

ERC-8004 is analyzed as an empirical crawl of Identity/Reputation events, off-chain files, gas costs, and x402 settlements across three chains. The identity-activity gap (URI activation, compliance, service endpoints) is a direct classification of registration files against the protocol’s own type field and URI resolution. The C1–C4 design arguments follow from the published contract interface and specification (untyped value/tag fields, arithmetic-mean getSummary, no interaction proof, gas-only cost) and do not rest on fitted parameters or self-citation uniqueness theorems. Sybil fractions and post-removal “no-baseline” rates are the output of an explicit shared-first-funder heuristic applied to the funding graph; the heuristic may be imperfect (false positives from legitimate multi-wallet operators), but that is a validity concern, not a reduction of the result to its own definition. No equation equates a claimed prediction to a fitted input by construction, no load-bearing uniqueness is imported from the authors’ prior work, and no known empirical pattern is merely renamed. The paper is therefore self-contained against its external data and the protocol text; circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

Empirical measurement paper; load-bearing choices are classification thresholds and the Sybil-detection heuristic rather than free physical parameters or invented particles. Background assumptions are standard blockchain-event semantics and the ERC-8004 contract interface.

free parameters (3)
  • off-scale value threshold = 100
    ˜v < 0 or ˜v > 100 used to flag non-rating uses of the value field; chosen by inspection of the observed distribution rather than derived.
  • trust-threshold τ for flip analysis = 90
    Representative threshold τ = 90 (and range 70–95) used to compute how many ceiling ratings flip an agent; illustrative, not fitted.
  • Sybil first-funder clustering rule
    Reviewers sharing a common first native-token funder (EOA or delegated EOA) are treated as coordinated; the exact graph-construction choices are design decisions of the detector.
assumptions (4)
  • domain assumption On-chain events emitted by the Identity and Reputation registries correctly record all registrations and feedback submissions that occurred in the observation window.
    Standard blockchain-data assumption; invoked throughout §4–§7.
  • ad hoc to paper An agent is 'active' only if its current URI resolves to a compliant ERC-8004 registration file that declares at least one service endpoint.
    Operational definition introduced in §5.4; other liveness predicates are possible.
  • ad hoc to paper Shared first-funder provenance is evidence of coordinated Sybil behavior rather than legitimate multi-wallet use.
    Core detection axiom of §7.6; false-positive rate unmeasured.
  • domain assumption Arithmetic mean of normalized feedback values is the aggregation consumers would use in the absence of further filtering.
    Matches the on-chain getSummary() default and the protocol's own warning about unfiltered aggregation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem." pith.science (2026). https://pith.science/paper/SMFBYZKT

@misc{pith2026260626028,
  author       = {Pith},
  title        = {Pith review of: Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SMFBYZKT}},
  note         = {Machine review of arXiv:2606.26028}
}
read the original abstract

As autonomous AI agents increasingly transact across organizational boundaries, a fundamental trust challenge emerges: how can an agent assess whether an unknown counterpart is trustworthy? The ERC-8004 protocol addresses this challenge with the first permissionless trust layer for AI agent economies, built around three on-chain registries for Identity, Reputation, and Validation. Despite its rapid adoption, the protocol has not been studied empirically, leaving it unclear whether the information it records provides a trustworthy basis for decision-making. To address this gap, we present the first empirical study of ERC-8004 across three chains: Ethereum, BNB Smart Chain (BSC), and Base, covering the period from protocol deployment through May 13, 2026. We crawl on-chain Identity and Reputation events, off-chain files, and x402 payment transactions. On the identity side, we find that most registrations are placeholders rather than active agents, with only a small fraction (3%, 4%, and 15% across Ethereum, BSC, and Base) exposing a valid ERC-8004 registration file with at least one live service endpoint. On the reputation side, we show that the Registry, as currently deployed, cannot function as a trust signal: values are not commensurable, feedback records are rarely grounded in verifiable interactions, and reputation can be manipulated at minimal cost. Consistent with these design weaknesses, we find that a substantial fraction of reviewers (73.5%, 59.2%, and 90.6% across Ethereum, BSC, and Base) exhibit coordinated Sybil behavior. After removing Sybil-flagged feedback, 15.8%, 77.9%, and 86.8% of rated agents, respectively, are left with no valid feedback. We then turn these findings into concrete recommendations for future revisions of ERC-8004. Our study yields actionable protocol-design implications and establishes an empirical baseline for research on AI agent markets.

Figures

Figures reproduced from arXiv: 2606.26028 by the authors.

Figure 1
Figure 1. ERC-8004 protocol architecture [13]. Three on-chain singleton registries, Identity (ERC-721), Reputation, and Validation, anchor only pointers and commitments (URIs and hashes), while content-heavy artifacts (registration files, feedback payloads, validator evidence) live off-chain (e.g., on IPFS/HTTPS). 3.2 Reputation Registry The Reputation Registry records client feedback as compact on-chain signals, exposing rep… view at source ↗
Figure 2
Figure 2. Cumulative agent registrations (solid), valid [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 4
Figure 4. Ownership concentration of agents across Ethereum, BSC, and Base (Lorenz curves). [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (14 more)
Figure 5
Figure 5. Figure 5: Distribution of agent URI activation status at [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Distribution of agent URI scheme by chain. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 9
Figure 9. Figure 9: Distribution of declared service types among valid ERC-8004 agents with active services. [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: Distribution of normalized feedback values across three chains. The main histogram covers the [ [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Top 10 feedback evaluation dimensions (tag1) with their two most frequent sub-dimensions (tag2). Tag semantics [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: Mean normalized reputation scores for agents declaring registration on both BSC and Base and on [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: Value distribution for 𝑣˜ > 100 (Base chain). 0 100 200 300 400 500 600 700 Count reliability performance creditscore response-time test safety-score revenues 1 1 2 3 6 21 730 [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 15
Figure 15. Figure 15: Cumulative distribution of 𝑘, the number of ceiling-valued ratings an adversary must add to push an agent’s score past the trust threshold 𝜏 = 90. A smaller 𝑘 means the agent is cheaper to manipulate. 70 75 80 85 90 95 Trust threshold τ 0.0 0.2 0.4 0.6 0.8 1.0 Fra cti…
Figure 17
Figure 17. Figure 17: Feedback records classified by the strongest [PITH_FULL_IMAGE:figures/full_fig_p015_17.png]
Figure 19
Figure 19. Figure 19: Shared funding provenance. Bars decompose [PITH_FULL_IMAGE:figures/full_fig_p017_19.png]
Figure 21
Figure 21. Figure 21: The agentic-internet stack. ERC-8004 supplies the missing [PITH_FULL_IMAGE:figures/full_fig_p023_21.png]
Figure 22
Figure 22. Figure 22: Two on-chain forms of an x402 payment. Solid edges are x402 settlements (EIP-3009, emitting AuthorizationUsed and Transfer). In the direct form (top), the payer settles USDC straight to the agent’s declared wallet, i.e., its ERC-8004 payment address. In the escrow for…
Figure 23
Figure 23. Figure 23: Distribution of the time between registration [PITH_FULL_IMAGE:figures/full_fig_p029_23.png]
Figure 25
Figure 25. Figure 25: Two-dimensional quality typology. BASE BSC ETH 0.0 0.2 0.4 0.6 0.8 1.0 share within chain genuine templated_inert thin_active empty [PITH_FULL_IMAGE:figures/full_fig_p029_25.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Agent-to-Agent Finance: Blockchain Payments and Trust Infrastructure for Autonomous AI Agents

    q-fin.GN 2026-06 unverdicted novelty 3.0 of 10

    Agent-to-agent finance is framed as the machine-mediated financial layer where autonomous agents use programmable settlement, smart wallets, and decentralized registries to transact while maintaining verifiability.

Reference graph

Works this paper leans on

53 extracted references · 9 linked inside Pith · cited by 1 Pith paper

  1. [1]

    A2A Protocol Organization. 2025. A2A and MCP: Detailed Comparison. A2A Protocol Documentation. Available at: https://a2a-protocol.org/latest/topics/a2a-and-mcp/?utm_source=chatgpt.com

    2025

  2. [2]

    Agentic Commerce Protocol Contributors. 2026. Agentic Commerce Protocol. GitHub Repository. Available at: https://github.com/agentic-commerce-protocol/agentic-commerce-protocol

    2026

  3. [3]

    Anthropic. 2024. Introducing the Model Context Protocol. Anthropic Documentation. Available at: https://www. anthropic.com/news/model-context-protocol

    2024

  4. [4]

    Remco Bloemen, Leonid Logvinov, and Jacob Evans. 2017. EIP-712: Typed Structured Data Hashing and Signing. Ethereum Improvement Proposals, no. 712. https://eips.ethereum.org/EIPS/eip-712

    2017

  5. [5]

    Eric Budish, Andrew Lewis-Pye, and Tim Roughgarden. 2024. The economic limits of permissionless consensus. In ACM Conference on Economics and Computation (EC). 704–731

    2024

  6. [6]

    Vitalik Buterin. 2016. EIP-155: Simple Replay Attack Protection. Ethereum Improvement Proposals, no. 155. https: //eips.ethereum.org/EIPS/eip-155

    2016

  7. [7]

    Bing-Jyue Chen, Suppakit Waiwitlikhit, Ion Stoica, and Daniel Kang. 2024. ZKML: An Optimizing System for ML Inference in Zero-Knowledge Proofs. InProceedings of the European Conference on Computer Systems (EuroSys). 560–574

    2024

  8. [8]

    Mohd Sameen Chishti, Damilare Peter Oyinloye, and Jingyue Li. 2026. AgentReputation: A Decentralized Agentic AI Reputation Framework.arXiv preprint arXiv:2605.00073(2026)

    arXiv 2026

Show all 53 references
  1. [9]

    Arka Rai Choudhuri, Sanjam Garg, Keewoo Lee, Hart Montgomery, Guru Vamsi Policharla, and Rohit Sinha. 2026. A Cryptographic Framework for Proof of Personhood.Cryptology ePrint Archive(2026)

    2026

  2. [10]

    Coinbase. 2025. x402: HTTP Payment Protocol for AI Agents. Coinbase Developer. Avaliable at: https://www.x402.org/

    2025

  3. [11]

    Victor Costan and Srinivas Devadas. 2016. Intel SGX Explained.IACR Cryptol. ePrint Arch.2016, 86 (2016), 1–118

    2016

  4. [12]

    Elizabeth Crites, Aggelos Kiayias, Markulf Kohlweiss, and Amirreza Sarencheh. 2025. SyRA: Sybil-resilient anonymous signatures with applications to decentralized identity. InACM SIGSAC Conference on Computer and Communications Security (CCS). 423–437

    2025

  5. [13]

    Marco De Rossi, Davide Crapis, Jordan Ellis, and Erik Reppel. 2025. ERC-8004: Trustless Agents. Ethereum Improvement Proposals, no. 8004. Available at: https://eips.ethereum.org/EIPS/eip-8004

    2025

  6. [14]

    William Entriken, Dieter Shirley, Jacob Evans, and Nastassia Sachs. 2018. EIP-721: Non-Fungible Token Standard. Ethereum Improvement Proposals, no. 721. Available at: https://eips.ethereum.org/EIPS/eip-721

    2018

  7. [15]

    ERC-8004 Contributors. 2024. ERC-8004 Contracts. GitHub repository. Available at: https://github.com/erc-8004/erc- 8004-contracts

    2024

  8. [16]

    Efat Fathalla, Mohamed Azab, Chunsheng Xin, and Hongyi Wu. 2026. Self-sovereign identity as a secure and trustworthy approach to digital identity management: A comprehensive survey.ACM Computing Surveys (CSUR)58, 7 (2026), 1–47

    2026

  9. [17]

    Francisco Giordano, Matt Condon, Philippe Castonguay, Amir Bandeali, and Jacob Evans. 2018. ERC-1271: Standard Signature Validation Method for Contracts. Ethereum Improvement Proposals, no. 1271. https://eips.ethereum.org/ EIPS/eip-1271

    2018

  10. [18]

    Mehul Goenka, Tejas Pathak, and Siddharth Asthana. 2026. TessPay: Verify-then-Pay Infrastructure for Trusted Agentic Commerce.arXiv preprint arXiv:2602.00213(2026)

    2026

  11. [19]

    Google. 2025. Announcing the Agent2Agent Protocol (A2A). Google Developers Blog. Available at: https://developers. googleblog.com/en/a2a-a-new-era-of-agent-interoperability/

    2025

  12. [20]

    Shaolong Guo, Yuntao Wang, Zhou Su, Yanghe Pan, Qinnan Hu, and Tom H Luan. 2026. Agent Discovery in Internet of Agents: Challenges and Solutions.IEEE Network(2026)

    2026

  13. [21]

    Omar Hasan, Lionel Brunie, and Elisa Bertino. 2022. Privacy-preserving reputation systems based on blockchain and other cryptographic building blocks: A survey.ACM Computing Surveys (CSUR)55, 2 (2022), 1–37

    2022

  14. [22]

    Helixa. 2026. Helixa: Onchain Identity and Reputation for AI Agents. Project website; Base mainnet contract 0x2e3B541C59D38b84E3Bc54e977200230A204Fe60. Available at: https://helixa.xyz

    2026

  15. [23]

    Botao Amber Hu and Helena Rong. 2025. Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design—A2A, AP2, ERC-8004, and Beyond.arXiv preprint arXiv:2511.03434(2025)

    2025

  16. [24]

    Jennings, and Nigel R

    Trung Dong Huynh, Nicholas R. Jennings, and Nigel R. Shadbolt. 2006. An Integrated Trust and Reputation Model for Open Multi-Agent Systems.Autonomous Agents and Multi-Agent Systems13, 2 (2006), 119–154. doi:10.1007/s10458- 005-6825-4

    2006 doi

  17. [25]

    Yanna Jiang, Delong Li, Haiyu Deng, Baihe Ma, Xu Wang, Qin Wang, and Guangsheng Yu. 2026. SoK: Agentic Skills–Beyond Tool Use in LLM Agents.arXiv preprint arXiv:2602.20867(2026)

    2026 arXiv

  18. [26]

    Audun Jøsang, Roslan Ismail, and Colin Boyd. 2007. A Survey of Trust and Reputation Systems for Online Service Provision.Decision Support Systems43, 2 (2007), 618–644. doi:10.1016/j.dss.2005.05.019 22 Xiong et al

    2007 doi

  19. [27]

    Juhee Kim, Wenbo Guo, and Dawn Song. 2026. SoK: Attack and defense landscape of agentic AI systems. InUSENIX Security Symposium (USENIX Sec)

    2026

  20. [28]

    Peter Jihoon Kim, Kevin Britz, and David Knott. 2020. EIP-3009: Transfer With Authorization. Ethereum Improvement Proposals, no. 3009. https://eips.ethereum.org/EIPS/eip-3009

    2020

  21. [29]

    Lightning Labs. 2025. L402: Lightning HTTP 402 Protocol.Accessed June 2026. https:// docs.lightning.engineering/ the- lightning-network/ l402(2025)

    2025

  22. [30]

    Yue Li, Lei Wang, Kaixuan Wang, Zhiqiang Yang, Ke Wang, Zhi Guan, and Jianbo Gao. 2026. A402: Binding Cryp- tocurrency Payments to Service Execution for Agentic Commerce.arXiv preprint arXiv:2603.01179(2026)

    2026

  23. [31]

    Zelin Li, Qin Wang, and Zhipeng Wang. 2026. Five Attacks on x402 Agentic Payment Protocol.arXiv preprint arXiv:2605.11781(2026)

    2026 arXiv

  24. [32]

    Shengchen Ling, Yihang Huang, Yuefeng Du, Yuan Chen, Yajin Zhou, Lei Wu, and Cong Wang. 2026. Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments.arXiv preprint arXiv:2605.30998(2026)

    2026 arXiv

  25. [33]

    Qiangqiang Liu, Qian Huang, Frank Fan, Haishan Wu, and Xueyan Tang. 2025. Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach. InIEEE International Conference on Blockchain and Cryptocurrency (ICBC)

    2025

  26. [34]

    Yulin Liu. 2026. A Dataset of Early Blockchain-Registered AI Agents on Ethereum.arXiv preprint arXiv:2604.22652 (2026)

    2026 arXiv

  27. [35]

    Yizhong Liu, Zedan Zhao, Boyu Zhao, Feiang Ran, Xun Lin, Dawei Li, and Zhenyu Guan. 2025. Fully anonymous decentralized identity supporting threshold traceability with practical blockchain. InACM The Web Conference (WWW)

    2025

  28. [36]

    Yuwei Lou, Hao Hu, Shaocong Ma, Zongfei Zhang, Liang Wang, Jidong Ge, and Xianping Tao. 2025. DRF: LLM-AGENT Dynamic Reputation Filtering Framework.arXiv preprint arXiv:2509.05764(2025)

    2025 arXiv

  29. [37]

    Elizabeth Lui, Rui Sun, Vatsal Shah, Xihan Xiong, Jiahao Sun, Davide Crapis, William Knottenbelt, and Zhipeng Wang

  30. [38]

    SoK: Blockchain-Based Decentralized AI (DeAI).arXiv preprint arXiv:2411.17461(2024)

    2024

  31. [39]

    Qian’ang Mao, Jiaxin Wang, Ya Liu, Li Zhu, Cong Ma, and Jiaqi Yan. 2026. SoK: Security of Autonomous LLM Agents in Agentic Commerce.arXiv preprint arXiv:2604.15367(2026)

    2026 arXiv

  32. [40]

    Carlo Mazzocca, Abbas Acar, Selcuk Uluagac, Rebecca Montanari, Paolo Bellavista, and Mauro Conti. 2025. A survey on decentralized identifiers and verifiable credentials.IEEE Communications Surveys & Tutorials(2025)

    2025

  33. [41]

    Nuwa Protocol. 2026. nuwa-8004: ERC-8004 Implementation Contracts for xNUWA. GitHub repository, fork of the ERC-8004 reference implementation. Available at: https://github.com/nuwa-protocol/nuwa-8004

    2026

  34. [42]

    Open Agentic Schema Framework Contributors. 2025. Open Agentic Schema Framework (OASF). AGNTCY project documentation. https://github.com/agntcy/oasf

    2025

  35. [43]

    Michele Orrù. 2025. Revisiting keyed-verification Anonymous credentials. InACM SIGSAC Conference on Computer and Communications Security (CCS). 1188–1199

    2025

  36. [44]

    Joon Sung Park, Joseph O’Brien, Carrie Jun Cai, Meredith Ringel Morris, Percy Liang, and Michael S Bernstein. 2023. Generative agents: Interactive simulacra of human behavior. InProceedings of the Annual ACM Symposium on User Interface Software and Technology (UIST). 1–22

    2023

  37. [45]

    QuantuLabs. 2026. 8004-solana: An ERC-8004 SDK for Solana. GitHub repository. Available at: https://github.com/ QuantuLabs/8004-solana

    2026

  38. [46]

    Tayebeh Rajabi, Alvi Ataur Khalil, Mohammad Hossein Manshaei, Mohammad Ashiqur Rahman, Mohammad Dakhi- lalian, Maurice Ngouen, Murtuza Jadliwala, and A Selcuk Uluagac. 2023. Feasibility analysis for sybil attacks in shard-based permissionless blockchains.Distributed Ledger Tec...

    2023

  39. [47]

    Siyue Ren, Wanli Fu, Xinkun Zou, Chen Shen, Yi Cai, Chen Chu, Zhen Wang, and Shuyue Hu. 2025. Beyond the Tragedy of the Commons: Building A Reputation System for Generative Multi-agent Systems.arXiv preprint arXiv:2505.05029 (2025)

    2025

  40. [48]

    Ranjan Sapkota, Konstantinos I Roumeliotis, and Manoj Karkee. 2025. Ai agents vs. agentic ai: A conceptual taxonomy, applications and challenges.Information Fusion(2025), 103599

    2025

  41. [49]

    Manu Sporny, Dave Longley, Markus Sabadello, Drummond Reed, Orie Steele, and Christopher Allen. 2022. Decentral- ized Identifiers (DIDs) v1.0. W3C Recommendation. Available at: https://www.w3.org/TR/did-core/

    2022

  42. [50]

    Rui Sun, Zhipeng Wang, Jiahao Sun, and Rajiv Ranjan. 2025. Vision: How to fully unleash the productivity of agentic ai? decentralized agent swarm network. InICML 2025 Workshop on Collaborative and Federated Agentic Workflows

    2025

  43. [51]

    Nenad Tomasev, Matija Franklin, Joel Z Leibo, Julian Jacobs, William A Cunningham, Iason Gabriel, and Simon Osindero. 2025. Virtual agent economies.arXiv preprint arXiv:2509.10147(2025)

    2025 arXiv

  44. [52]

    Jiangshan Yu, David Kozhaya, Jeremie Decouchant, and Paulo Esteves-Verissimo. 2019. Repucoin: Your reputation is your power.IEEE Transactions on Computers (TC)68, 8 (2019), 1225–1237

    2019

  45. [53]

    Payment Required

    Yuanzhe Zhang, Yuexin Xiang, Yuchen Lei, Qin Wang, Tian Qiu, Yujing Sun, Spiridon Zarkov, Tsz Hon Yuen, Andreas Deppeler, Jiangshan Yu, and Kwok-Yan Lam. 2026. SoK: Blockchain Agent-to-Agent Payments.arXiv preprint arXiv:2604.03733(2026). An Empirical Study of ERC-8004 23 A ER...

    2026 arXiv

Pith tools

Reviewed July 12, 2026 · model on record in the stance chip above.