Update ERC-8056: strengthen security considerations

[normanxbt]

Summary

This PR strengthens the Security Considerations for ERC-8056 without changing its interfaces, interface IDs, or reference implementation.

It adds explicit, machine-checkable requirements for:

• authorization and observability of multiplier changes;
• non-zero active and pending multipliers;
• isolation of multiplier updates from raw ERC-20 balances, total supply, and allowances;
• consistency of pending multiplier state and activation time;
• floor-rounding semantics for both conversion directions;
• full-precision arithmetic when the final result fits in uint256;
• consistency between UI balance views and the conversion extension; and
• UI/raw amount labeling plus oracle validation and fail-safe behavior.

Motivation and discussion

The existing Security Considerations identify access-control, overflow, user-confusion, and oracle risks, but do not define enough behavior for implementations and integrators to test those properties consistently.

• ERC-8056 discussion: https://ethereum-magicians.org/t/erc-8056-scaled-ui-amount-extension-for-erc-20-tokens/25899
• Reproducible security/FV contribution: https://github.com/normanxbt/erc-8056-security-fv-review/tree/b06e163a5a1d120608a0b966917be4b6852cbff2

The linked repository pins the reviewed implementation and includes Certora specifications, configurations, deterministic Foundry tests, exact commands, source hashes, and direct Prover reports. For that pinned implementation, 21 distinct Certora rules (22 executions across five configurations) pass, and the deterministic Foundry suite passes 8/8 tests.

The formal results are implementation-scoped. They are provided as reproducible evidence for the portable security properties expressed by this specification change, not as a claim that all ERC-8056 implementations are proven.

Scope

Only ERCS/erc-8056.md is changed, and only its Security Considerations section is rewritten.

[eip-review-bot]

File ERCS/erc-8056.md

Requires 1 more review from Authors: @cridmann, @gretzke, @tinom9