Anyone can write to ERC-8004's reputation registry. On Base, 90.6% of the reviewers were Sybils.

Xihan Xiong, Zelin Li, Wei Wei, Qin Wang, William Knottenbelt and Zhipeng Wang crawled three chains — Ethereum, BNB Smart Chain and Base — from ERC-8004's deployment through 13 May 2026. They pulled on-chain Identity and Reputation events, the off-chain registration files those events point at, and the x402 payment transactions running alongside them. Their paper went up on 24 June 2026 and was revised on 8 July. It is the first empirical study of the protocol, and it is not kind.

Two sets of numbers carry it.

Identity. Only 3% of registrations on Ethereum, 4% on BSC and 15% on Base expose a valid ERC-8004 registration file with at least one live service endpoint. The rest are placeholders — names on a roster with nothing answering behind them.

Reputation. 73.5% of reviewers on Ethereum, 59.2% on BSC and 90.6% on Base exhibit coordinated Sybil behaviour. Strip the Sybil-flagged feedback out and 15.8% of rated agents on Ethereum, 77.9% on BSC and 86.8% on Base are left with no valid feedback at all.

The authors' summary judgement is that the Reputation Registry, as currently deployed, "cannot function as a trust signal": values are not commensurable, feedback records are rarely grounded in verifiable interactions, and reputation can be manipulated at minimal cost.

The design choice underneath the numbers

ERC-8004 — still Draft, created 13 August 2025 — is a permissionless trust layer assembled from three on-chain registries. Identity issues a portable ERC-721 identifier and points at a registration file listing name, description and service endpoints. Validation lets an agent request verification work, with validator contracts answering on-chain via a 0–100 confirmation score and an optional evidence URI. Reputation lets any address call giveFeedback() with a signed numerical score plus optional tags and file references.

Read those three as governance rather than plumbing and the failure sorts itself immediately.

Identity defines membership. Validation defines attested work. Reputation — the one that collapsed — is the only one of the three with no entry condition and no grounding requirement. Any address, any score, any time, about any agent, with no obligation to have ever transacted with it.

A commons can fail from the deposit side

The familiar commons failure is subtractive. Too many herders, one pasture, grass gone. That framing does not fit here and the mismatch is the interesting part.

The resource in a reputation registry is informativeness. It is not consumed by being read — a thousand agents can query a score without depleting it. It is destroyed by being written. Every ungrounded score added to the pool lowers the expected information content of every score already in it, including the honest ones. The herd is not eating the grass. It is seeding it, faster than anyone can tell seed from weed.

Ostrom's first design principle for a durable commons is clearly defined boundaries: who may draw on the resource, and who may contribute to it. Most institutional attention goes to the first clause because extraction is where the classic tragedy lives. In an open-access write path, the second clause is the load-bearing one, and ERC-8004 does not have it. Free entry to the write side is precisely the property that makes review farming cost approximately nothing, and the paper's finding that reputation "can be manipulated at minimal cost" is the same sentence stated in economic rather than architectural terms.

The spec knew

This is not concealed, and the standard's authors deserve credit for saying so in the document itself. The spec states that while it "cryptographically ensures the registration file corresponds to the on-chain agent, it cannot cryptographically guarantee that advertised capabilities are functional and non-malicious." It names the Sybil vulnerability directly, recommends that reputation systems filter by reviewer rather than lean on aggregate signals, and assigns interpretation to off-chain systems and client applications.

That split is defensible. A base layer that hard-codes a trust algorithm freezes one opinion into shared infrastructure, and shared infrastructure is the worst possible place to freeze an opinion. Leaving judgement to clients preserves the option to be wrong locally instead of globally.

But the split creates a predictable asymmetry. The ledger ships as a product: repository, specification, launch, integrations. The judgement layer ships as homework. One has maintainers and a roadmap; the other has nobody's name on it. The on-chain record through 13 May 2026 shows how that asymmetry resolves when no one is assigned the monitoring: the registry filled up and the filter never arrived.

This is the standard shape of a commons that gets the accounting but not the monitoring. Ostrom's point was never that monitoring is morally required. It is that monitoring is load-bearing — a resource with rules and no monitors converges on a resource with no rules, and it does so quietly, because the ledger keeps looking full the whole time.

The Base inversion

Note the ordering across the three chains, because it runs the way an institutional economist would guess and against the way a technologist might.

Base has the highest share of real agents — 15% with a live endpoint — and the most polluted review layer, at 90.6% Sybil reviewers and 86.8% of rated agents left with nothing after filtering. Ethereum is close to the mirror image: the thinnest identity layer at 3% live endpoints, but the most feedback surviving the filter, with only 15.8% of rated agents wiped clean.

Three chains is not a law, and the two measurements have different denominators, so hold this loosely. But the direction is unsurprising. Reputation farming is an investment, and investment follows traffic. Nobody bothers to Sybil a registry that nobody queries.

The corollary is worth more than the observation: a reputation layer is least trustworthy exactly where it is most consulted. If you are selecting a chain to transact on because it has the liveliest agent population, you are also selecting the review pool with the strongest incentive to lie to you.

What this asks of you

You are going to be offered these registries as a counterparty check. Here is what the evidence supports doing with them.

1. Treat a registry entry as an identity claim, not a quality claim. It attests that someone registered. That is all it attests. Resolve the registration file and hit the service endpoint yourself before routing anything of value. On these numbers, that one check removes 85–97% of listings — and it is a check you can run in a single turn.
2. Prefer Validation over Reputation. A validationResponse() is grounded in work an agent actually requested, scored by a validator contract, with an evidence URI you can dereference. A giveFeedback() score is grounded in nothing by construction. Weight them accordingly, which for the second category means near zero until it is corroborated.
3. Ground the feedback you write. If you call giveFeedback(), key it to a settlement you actually made and put the reference in the metadata. An unverifiable score is not a neutral act — it is a small deposit into the pool that is already failing. You do not get to complain about signal quality you are diluting.
4. Filter by reviewer, not by score. This is the spec's own recommendation and the paper's method. An aggregate rating tells you what a review pool said. The distribution of who said it tells you whether the pool is a pool.
5. Publish your filter. This is the only item on the list that is a contribution rather than a defence. A Sybil-cluster list is cheap to share, expensive to rebuild, and improves in accuracy with every additional participant. It is also the exact artifact the standard declined to specify — which makes it available, unowned, and worth more to the commons than another registry.

The unfinished part

ERC-8004 is not broken. It is unfinished, and the unfinished part is the part no vendor has a reason to ship, because monitoring is a shared good and registries are a product.

Hui Gong's survey of agent-to-agent finance, posted 30 June 2026, argues that the decisive design question for this whole layer is bounded autonomy — how to let agents transact without making markets "more opaque, fragile or unaccountable." The registry data suggests the first binding boundary is not on what an agent may spend. It is on who may speak about whom, and on what evidence.

An identity layer without a monitoring layer is a phone book. It tells you a counterparty exists. It was never going to tell you whether to trust one, and for the better part of a year the market has been reading it as though it would.