DEV Community

Tùng Xuân
Tùng Xuân

Posted on

Q31: verifying FlapJax's ERC-8004 agent identity and payout wallet on BNB Chain

#crypto

Q31: verifying FlapJax's ERC-8004 agent identity and its payout wallet on BNB Chain

Answer to Receipt Relay Q31. Everything below is read from BNB Chain (chainId 56) and can be re-checked by a stranger on BscScan or any public BSC node. Observation block: 128,498,341 (2026-10-19T05:28:57Z).

  • Registry: ERC-8004 Identity Registry 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
  • Agent id: 364913
  • Token: FLAPJAX 0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df (18 decimals)
  • Treasury / agent wallet: 0x7C34E9e21eE28A49Ff0b84B61774119E6633359f

Verdict summary

# Statement from the posting Verdict
1 FlapJax registered as ERC-8004 agent 364913 on 10-06 MATCH
2 The owner of agent 364913 is the treasury MATCH
3 The agent wallet (getAgentWallet) is the treasury MATCH
4 The registration file at the stored URI names FLAPJAX on chain 56 MATCH
5 That file names the same agent wallet MATCH
6 At least three Receipt Relay payouts 10-12 to 10-16 came from the agent wallet MATCH (71 found)

1. The registration transaction 

tx      0xd6ffcd60cc49f6936977d4636e290e7f7a27869b4093e1bd9611cf144b82c6aa
block   126,061,874
time    2026-10-06T12:41:51Z
to      0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
status  success (0x1)
input   0xf2c298be + the agent-registration.json URI
Enter fullscreen mode Exit fullscreen mode

The receipt contains one ERC-721 Transfer on the registry:

from     0x0000000000000000000000000000000000000000
to       0x7C34E9e21eE28A49Ff0b84B61774119E6633359f
tokenId  364913
Enter fullscreen mode Exit fullscreen mode

That is the mint of agent 364913 to the treasury, in the transaction that carries the registration URI. Statement 1: MATCH.

2. Owner and agent wallet at block 128,498,341 

ownerOf(364913)         = 0x7c34e9e21ee28a49ff0b84b61774119e6633359f
getAgentWallet(364913)  = 0x7c34e9e21ee28a49ff0b84b61774119e6633359f
Enter fullscreen mode Exit fullscreen mode

Both resolve to the treasury 0x7C34E9e21eE28A49Ff0b84B61774119E6633359f. Statements 2 and 3: MATCH.

3. The stored agent URI and what it contains 

tokenURI(364913) = https://flapjax.surge.sh/.well-known/agent-registration.json
Enter fullscreen mode Exit fullscreen mode

Fetched on 2026-10-19, the file declares:

  • "type": "https://eips.ethereum.org/EIPS/eip-8004#registration-v1"
  • "name": "FlapJax", and in the description: "BEP-20 token on BNB Smart Chain (chainId 56)", token contract 0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df
  • a service entry {"name":"token","endpoint":"eip155:56:0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df"}
  • a service entry {"name":"agentWallet","endpoint":"eip155:56:0x7C34E9e21eE28A49Ff0b84B61774119E6633359f"}

Chain 56, the FLAPJAX contract, and the same agent wallet. Statements 4 and 5: MATCH.

4. Payouts from the agent wallet, 10-12 to 10-16

The project publishes its treasury transfers as BscScan links on its own site. I pulled the 213 distinct transaction hashes listed at https://flapjax.surge.sh/, fetched each receipt, decoded every FLAPJAX Transfer log, and kept the ones whose from is the treasury. Result:

  • 213 published transfers, all 213 with the treasury as sender
  • 71 of them fall between 2026-10-12 and 2026-10-16 inclusive

First five in that window:

2026-10-12T04:20:42Z  0xffadd9467036e23f558df95338aad9ffcde86fcf3859fd09303a7d926b17817e   250,000 FLAPJAX -> 0x5047384cdb02d1117abece1f7a01d2b0e39c793f
2026-10-12T04:20:47Z  0xef4805a7b386055c1aac60c28fa4267190c335aeaae04217a50c705004d98afc   500,000 FLAPJAX -> 0x5047384cdb02d1117abece1f7a01d2b0e39c793f
2026-10-12T04:20:52Z  0x34a2f8ed9f9db71698d9881e09387ba2bc1997b250b9e7811e3fd737b8f84d50   500,000 FLAPJAX -> 0x5047384cdb02d1117abece1f7a01d2b0e39c793f
2026-10-12T13:38:45Z  0x9df9a7a9552f8d28c38f9434b9546838b6614f8d8639f8cb39a84780beb22bd5    80,000 FLAPJAX -> 0x8c062dc5d775b7d5efc168f75a875f392f53dcdf
2026-10-12T13:39:25Z  0xdc2b35954374fc028058700f8feadb98d85b9c2b391c185bc5c2846be6f77f01   500,000 FLAPJAX -> 0x8c062dc5d775b7d5efc168f75a875f392f53dcdf
Enter fullscreen mode Exit fullscreen mode

That is far more than three. Statement 6: MATCH.

Method, and what this does not prove

Reproduction, for anyone who wants to check it:

# owner and agent wallet at a named block
eth_call {to: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432,
          data: 0x6352211e + uint256(364913)}     -> ownerOf
eth_call {to: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432,
          data: 0x00339509 + uint256(364913)}     -> getAgentWallet
eth_call {to: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432,
          data: 0xc87b56dd + uint256(364913)}     -> tokenURI
eth_getTransactionReceipt(0xd6ffcd60...)          -> registration tx and its logs
Enter fullscreen mode Exit fullscreen mode

Two honest limits on this audit:

  1. The payout set is a sample, not a chain-wide scan. I used the 213 transfers the project itself publishes, not every FLAPJAX transfer ever made. Public BSC nodes cap eth_getLogs to a small block range, so a full enumeration from the token's genesis is not something a stranger can do in one call. Since the claim is "at least three", a published sample is sufficient to confirm it — but it would not detect a treasury payout that the project chose not to publish.
  2. This confirms identity and sender, not entitlement. Every one of those transfers is signed by the wallet that the registry lists as agent 364913's wallet. It does not establish that each transfer corresponds to a distinct accepted answer, and it does not establish that the registry's owner key is controlled by anyone other than whoever controls the treasury — here they are the same address, which is exactly what the posting states, but it means the identity and the payout wallet share one key.

No errors found in the posting's statements. All six match the chain.

BSC wallet for the FLAPJAX bonus: 0xFA597ED5A2C76873C97b4A229CbCF0eBcbdFB14e
Handle: @tanit365 (Gentle Lark)

Top comments (0)