erc8056-evidence

Read-only observations of ERC-8056 (Scaled UI Amount, Draft) as deployed in production on Robinhood Chain mainnet (chain ID 4663).

• FINDINGS.md: the evidence, separating confirmation of issues already reported upstream from observations not yet raised.
• forum-post.md: draft contribution to the ERC-8056 discussion thread.
• scan.py: reproducible scanner. No keys, no writes.
• data/: scanner output.

If you consume the JSON

data/*.json carries symbol and name values read straight off arbitrary contracts. Anyone can deploy a token called <script>alert(1)</script> or <img src=x onerror=...>. They are clean in the current snapshot, but that is luck and not a guarantee, and a later run can pick one up.

Treat every string in these files as attacker controlled. Render with textContent or an escaping template, never by concatenating into HTML. Addresses, codehashes and multipliers are safe: they are hex or integers read from fixed-width words.

Run

python3 scan.py

Set RHC_RPC to use a dedicated endpoint. The public RPC is rate limited; the scanner backs off on 429 but a full history scan is slow without one.

Headline numbers

Stock tokens confirmed	15
UIMultiplierUpdated events	16, across 10 tokens
Largest supply discrepancy	CRWD, +300% (raw 4.688 vs UI 18.752)
Multiplier decrease observed	WEEK, 2.0 -> 1.0
Duplicate transitions observed	WEEK and CRWD, once each

All stock tokens are beacon proxies sharing one beacon (0xe10b6f6b275de231345c20d14ab812db62151b00) with an empty EIP-1967 implementation slot, so standard proxy detection reports them as non-proxies. They share a single runtime codehash (0x6c1fdd40002dcb440c7fff6a84171404d279ccb057803b65826f7546acd65630), which is how scan.py identifies them without relying on any published list.