The paper is Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem by Xihan Xiong, Zelin Li, Wei Wei, Qin Wang, William Knottenbelt, and Zhipeng Wang (Imperial College London), first posted to arXiv on 2026-06-24 and revised on 2026-07-08. Its data collection window closes on 2026-05-13. That matters: everything the paper reports is a photograph of the ecosystem three months before this post, before roughly a hundred days of new registrations, endpoint churn, and reputation activity.
We publish the continuous version of that dataset. This post's job is not to argue with the paper — the paper's core finding is one we have been publishing under our own name since Report 01. The job is to (1) state the two teams' predicate definitions explicitly so the numbers become commensurable, (2) show what has and has not changed in the three months since the paper's data froze, and (3) point to the one architectural fix — commerce-backed reputation — that directly addresses the paper's central complaint about the ReputationRegistry.
What the paper actually found
The paper studies three chains — Ethereum mainnet, BSC, and Base — and reports two headline results.
Result 1: most registrations are placeholders. The paper finds that only 3% (Ethereum), 4% (BSC), and 15% (Base) of ERC-8004 identity registrations satisfy both halves of its trust bar: a resolvable registration file and at least one live service endpoint. In the authors' own words, "most registrations are placeholders rather than active agents."
Result 2: the ReputationRegistry cannot function as a trust signal. The paper reports that 73.5% (Ethereum), 59.2% (BSC), and 90.6% (Base) of reviewers show coordinated Sybil behaviour, and that once Sybil feedback is stripped, 15.8% (Ethereum), 77.9% (BSC), and 86.8% (Base) of rated agents are left with no valid feedback at all. The authors write that the registry's values are "not commensurable", that feedback is "rarely grounded in verifiable interactions," and that the registry is manipulable at minimal cost.
Both results are empirical, dated 2026-05-13, and released under CC BY 4.0. They are the kind of independent measurement that has been missing from a category where every operator's numbers are their own.
The two predicates, side by side
Any comparison of the paper's number and ours has to begin with the fact that we are not measuring the same predicate.
| Predicate | Definition |
|---|---|
| Paper Xiong et al. 2026, data 2026-05-13 |
Registration file resolvable AND at least one live service endpoint declared. Registration file = the metadata document the agent points at from its ERC-8004 identity row (agent card, agent.json, or equivalent). "Live service endpoint" in this sense is a declared service in the metadata, not an actively probed 2xx response. |
| Us On-Chain Agent Intel, continuous |
Advertised endpoint returns HTTP 2xx on the last probe
(strict [200, 300)) AND advertises at least one
machine-readable capability surface — MCP
(/mcp), OpenAPI
(/openapi.json), or
/.well-known/agent-card.json
with a non-empty skills[]
or capabilities[]. Codified
in
smartcontractauditpro/liveness.py::is_live
and pinned by a dedicated unit-test file; the same helper
feeds
/v1/public/stats.live_by_chain,
the site's per-chain live counts, and every free per-agent
page — one predicate, one code path.
|
Both predicates are trying to filter out placeholder registrations. The paper does it with a static-document check; we do it with a continuous liveness probe. Ours is the stricter test — a resolvable registration file with a declared endpoint is a necessary but not sufficient condition for the endpoint to actually answer today.
We do not attempt to re-compute the paper's exact predicate on our data in this post. Doing so honestly would require re-fetching every agent's registration document at a point-in-time cut and applying the paper's specific resolver rules; that is a methodology paper of its own, not a paragraph. We flag it explicitly so readers do not misread "our live rate" and "the paper's 3% / 4% / 15%" as directly comparable.
Our live rates, three months later
Under our stricter predicate — advertised endpoint 2xx AND a machine-readable capability surface — this is what our continuous index reports right now:
| Measure (live, all-Ethereum index) | Value |
|---|---|
| ERC-8004 agents indexed (Base + Ethereum) | 25,618 |
| Live agents (endpoint 2xx AND capability declared) | 3,323 |
| Live rate — Base | 7% |
| Live rate — Ethereum mainnet | 58% |
| ReputationRegistry feedback events indexed | 277,710 |
| Agents that have received any feedback at all | 29,128 |
| Commerce-backed agents (got-paid cohort) | 44 |
Live-source: /v1/public/stats.
Liveness itself has been continuously tracked since
2026-07-17.
Two observations sit alongside the paper's headline. First, the direction matches — even under our stricter probe, a double-digit majority of registered ERC-8004 agents on Ethereum mainnet and Base are placeholders, exactly as the paper says. Second, the Base vs Ethereum ordering also matches — Base continues to show the higher live rate on our test, just as the paper showed the highest passing rate on Base under its own test. The specific per-chain percentages are not directly comparable (see the predicate table above), but the shape of the finding holds three months later.
Their BSC 4% next to our BNB decision
One of the paper's headline numbers is that only 4% of BSC registrations pass its trust bar — the middle of its three chains, well below Base and only marginally above Ethereum mainnet. Under our own multi-chain measurement in July, BNB Chain showed a live rate around 0.15% under our stricter capability-declared predicate, alongside zero commerce-backed agents on any snapshot we ever took. Two teams using two different predicates on the same chain both find that BNB is the weakest of the three by a wide margin. That convergence is exactly the third-party justification our Report 04 write-up was missing when we cut BNB out of the served surface and moved to an all-Ethereum posture (Base + Ethereum today, Arbitrum next).
The registry-can't-be-a-trust-signal complaint, and the fix
The paper's second finding is the more corrosive one: the ReputationRegistry values are "not commensurable" and feedback is "rarely grounded in verifiable interactions." Anyone can write a feedback row saying anything about anyone; a Sybil ring can flood the registry at effectively zero cost. Stripping the paper's estimated Sybil behaviour leaves 15.8% (Ethereum), 77.9% (BSC), and 86.8% (Base) of rated agents with no valid feedback at all — the trust signal collapses on inspection.
The architectural fix is to derive reputation from something a
Sybil ring cannot cheaply fabricate: a settled on-chain payment
between two agents. Our
commerce-backed cohort is
exactly that. A ReputationRegistry row only counts if its author
and its subject demonstrably transacted on-chain via an
ERC-8183
job outcome, a Virtuals ACP job, or one of a small allowlist of
known escrow / hook contracts. The canonical predicate lives at
smartcontractauditpro/commerce_backed.py,
with a per-agent classifier and a matching SQL predicate held in
agreement by a divergence-regression test. The cohort today
stands at
44
agents; Report
03 walks the methodology in long form.
This is not a rebuttal to the paper — the paper is right that the raw registry is not a trust signal on its own. It is the practical answer to the paper's complaint: build the filter on top of the registry, from data the registry cannot cheaply lie about.
What has and has not changed since 2026-05-13
The paper's data set closes on 2026-05-13. Since then:
- The ecosystem has kept adding placeholder registrations. Our index has grown to 25,618 agents on Base + Ethereum alone, but the live share has not rescued itself — a bigger denominator with a similar-shape numerator.
- On the two chains we still serve, ordering matches the paper: Base outperforms Ethereum mainnet on live rate. Our Base live rate today is 7%; Ethereum mainnet is 58%.
- BNB Chain has not converged. Two independent measurements, three months apart, using two different predicates, both find it the weakest of the three chains by a wide margin.
- The got-paid cohort exists and is countable. 44 agents now have a ReputationRegistry row that ties back to a real, paid on-chain job — a signal that did not exist in the paper's snapshot as a distinct category, and one that a Sybil ring cannot cheaply produce.
Attribution and reuse
The paper's numbers on this page are quoted under CC BY 4.0. Full attribution: Xihan Xiong, Zelin Li, Wei Wei, Qin Wang, William Knottenbelt, Zhipeng Wang (Imperial College London), Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem, arXiv:2606.26028 (v1 2026-06-24, v2 2026-07-08). DOI:10.48550/arXiv.2606.26028.
Our own data on this page is served live from
/v1/public/stats and refreshed
on every visit; the commerce-backed predicate is the single
canonical definition at
smartcontractauditpro/commerce_backed.py.
Redistribution of our figures is welcome under CC BY 4.0 with a
link back to this page.