You sign an EIP-3009 authorization, we broadcast it and pay the gas. No fee, no account, no API key. What is unusual here is not the traffic — it is that the wallet balance, the spend budget, every limit and the one attack we have not closed are all printed below.
https://facilitator.wicketworld.xyzCounting settlements is normal. Publishing how much gas money is left is not.
isValid is the word that makes a seller hand over the goods. A facilitator that answers isValid and then fails to settle has taken the goods and left no payment — denial of settlement, measured at 100% leakage in arXiv 2605.30998. So if we cannot settle, for any reason, we refuse at /verify before you have shipped anything.
A limit with no reason attached looks like meanness. Publishing them is the point: they are a promise you can hold us to.
Charging 1% of everything on Arc would earn $71 against $116 of gas. A facilitator fee is not a business on this chain; it is a position to hold.
Gas is about $0.002 a settle. Below the floor we would spend two tenths of a cent to move a millionth of a dollar.
One address cannot eat the whole day's budget. Getting around it means funding new wallets, which is not free.
The backstop. Whatever goes wrong, the most this can lose in a day is this number, and we chose it.
Cents clear on one confirmation. A thousand dollars waits for five. Nothing is called settled while a reorg could still erase it.
The transaction is already broadcast, so you get the hash rather than an error. Treating a timeout as failure is how a seller gives away goods that were in fact paid for.
Refusals return a standard x402 error reason so your client does not break, plus a non-standard naming the real cause. The floor is published at so you can read it before you send.
Three endpoints, x402 v2, scheme exact. Nothing to sign up for.
GET https://facilitator.wicketworld.xyz/supported
POST https://facilitator.wicketworld.xyz/verify
POST https://facilitator.wicketworld.xyz/settle
GET https://facilitator.wicketworld.xyz/healthz{
"assetTransferMethod": "eip3009",
"name": "USDC",
"version": "2"
}On Arc the USDC EIP-712 domain name is "USDC", not "USD Coin". Several SDKs default to the latter because it is right on other chains. Get it wrong and the signature recovers to a different address: no error, no warning, nothing works. Check DOMAIN_SEPARATOR() yourself — mainnet returns 0x940506929bba468048a19b567f4f0d534714bc06604b5c3017e5d16785ccdf84.
Two papers took x402 apart and measured how much each hole leaks. Every facilitator could publish this table. As far as we can tell, none does — least of all the part at the bottom.
The server hands over the goods before the settlement is final. A reorg then erases the payment.
howWe only report success after enough confirmations, and the number scales with the amount — one for cents, five for a thousand dollars.
arXiv 2605.11781 §I-ATwo requests carrying the same authorization arrive at once. Both pass verification, the server delivers twice, and only one transaction lands.
howThe pair (payer, nonce) is claimed atomically in the database at /verify. Twenty simultaneous claims produce exactly one winner.
arXiv 2605.30998Verification says yes, the server delivers, and settlement then fails. The seller has lost the goods and has no payment.
Every other facilitator reports its own numbers. Ours come out of the same public index anyone can query, under a detection rule published word for word — and it counts us exactly the way it counts everyone else.
Near the bottom, and staying there until that changes. 7 wallets are tied on 2 settlements, so below that point the order is by value.
Those settlements are us paying ourselves a cent into a burn address. They prove the path works on mainnet — signature, verification, broadcast, gas, replay protection. They do not mean anyone is using this. Nobody is, yet. When a payment arrives that we did not send, this section will say so, and you will be able to check it on the leaderboard like everything else.
wicketReason/metahowIf we cannot settle, we do not verify. When the hot wallet drops below the halt threshold, /verify refuses rather than saying isValid.
Someone signs authorizations moving a millionth of a dollar from their own wallet to their own wallet. Every one is valid, and every one costs us gas while costing them nothing.
howA value floor, a per-payer daily cap, and a daily gas ceiling. The ceiling is the real answer: whatever happens, the most we can lose in a day is a number we set.
not in either paper — specific to charging nothingSomeone reading the wire copies the payment header and settles it first. The nonce is burned, the payer is charged, and the payer never receives what they paid for.
Closing this needs a wrapper contract that checks msg.sender, and every seller would have to change payTo to point at it. That breaks compatibility with every x402 SDK in existence, so we have not done it. If this attack is in your threat model, do not rely on us for it.
Each closed row has a test that reproduces the attack and then proves the fix, and each test has a control case showing a legitimate request still gets through — without one, code that refused everything would score full marks. Same habit as the methodology page, which publishes what the explorer data cannot tell you.