{"id":"payee.facts.v1","title":"Payee facts: seven measurable things about an address an agent is about to pay","unit":"per payee and per request: seven facts, each true, false or unavailable, with evidence and the time measured","chain_set":"eip155:8453 (Base)","window":"the payee's last 7 days of stablecoin transfers (302,400 blocks) for the transfer-based facts; the latest block for code; the agent's whole counted-payment history before the request for the history-based facts","definition":"For one receiving address on Base, the Gate reports: (1) relay_shape, whether at least 80% of the inbound stablecoin transfers in the window were forwarded (80% or more of the amount, same token) within 10 minutes, given at least 3 inbound transfers (gate/facts.mjs RELAY_SHARE = 0.8 for both); (2) swap_unfreezable, whether at least half of the window's stablecoin outflow went to addresses labelled as swap venues; (3) funded_by_exits_to, the top five funders and top five destinations by USD in the window, plus how many registered agents have paid the address; (4) poisoning_lookalike, whether the address shares its first 3 and last 4 hex characters with a different address the paying agent paid or was funded by; (5) sweeper_7702, whether the address is an EIP-7702 delegated account whose delegate code matches a known sweeper fingerprint (keccak-256 of the runtime code) or has the tiny forwarder shape (at most 256 bytes, with CALL and SELFBALANCE or CALLVALUE); (6) pay_on_proof_claim, whether a contract payee's runtime code carries a known claim selector (a 'pay on proof' claim that may not bind the payee); (7) fresh_destination_size, whether the paying agent never paid this address before and the requested amount exceeds its largest earlier counted payment.","method":"eth_getCode at latest for the payee and, if delegated, its delegate; eth_getLogs for Transfer events on the four verified stablecoin contracts with the payee as sender or recipient over the window, chunked; the counterparty preview (/api/counterparty) for registered payers; the agent's counted payments from the ledger for the history facts; the venue label map (gate/venues.json) for swap venues; research/sweepers.json for sweeper fingerprints. A fact whose channel fails is reported as unavailable with the reason, never as false.","excludes":["Native ETH transfers (not stablecoin transfers).","Transfers older than the window.","Any judgement of the payee's business or identity.","Payees on chains other than Base."],"does_not_assert":["That a payee with a true fact is malicious, or that one with all facts false is legitimate.","That a claim selector means the claim is unsafe: whether it binds the payee needs the verified source.","That a look-alike was planted on purpose.","That the sweeper list is complete."],"assumptions":["The four stablecoin contracts and the venue labels are correct and current.","The agent's counted payments are complete for the history facts (the ledger's own set, not the 25-payment public view).","A log channel serves 7 days of Transfer events; without it the three transfer facts are unavailable."],"known_gaps":["On 14 Oct 2026 the free Base RPC endpoints served no (mainnet.base.org) or only the last ~4,000 blocks (publicnode) of logs, so the transfer facts could not be computed in the lab.","The sweeper fingerprint list holds 10 families, two verified on chain; a new delegate matches only through the tiny-forwarder shape.","Claim selectors are matched by PUSH4 scan of runtime code; proxies hide the implementation."],"intended_use":"Facts an operator's policy reads before signing (block, warn or log per fact), and the evidence lines of a Gate decision.","not_intended_for":"A verdict on a payee; a score; a public list of bad addresses.","cost_to_fake":"A payee can avoid relay_shape by holding funds longer than 10 minutes, swap_unfreezable by exiting through an unlabelled venue, and fresh_destination_size by receiving a small first payment (which probe_then_large then scores); it cannot change its code kind or its funders' history after the fact, and a look-alike must still be a different address.","threat_model":"Assume the model behind an agent can be steered by text it reads (a prompt injection, a poisoned tool result, a planted memory): every signal here is measured from the chain and our ledger, never from what the agent says, and nothing here is a verdict on an agent, an operator or a person.","source":"afg-security-lab gate/ (facts.mjs, POLICY.md, SAMPLES.md), 2026-10-14; production: AFG-Pulse (afg-oochar, afg-intake gate routes), 16 Oct 2026","since":"2026-10-16","status":"live from 16 Oct 2026 (/api/gate/facts, payee_facts); facts describe an address, they do not judge it","revisions":[],"body_sha256":"a2fd033380f41f2333e70194026319607b30307f19d389537de29556ec1123dc","url":"https://agenticfinancegraph.com/def/payee.facts.v1","ladder":"https://agenticfinancegraph.com/ai-agent-liveness-methodology-l0-l9-ladder","license":"https://creativecommons.org/licenses/by/4.0/","attribution":"Agentic Finance Graph — https://agenticfinancegraph.com"}