# Wicket

> The x402 explorer for Circle Arc. Wicket reads every block on Arc (chain id 5042, CAIP-2 eip155:5042) and indexes every x402 payment settlement found in it. Free to browse, free to query, no account and no API key.

Wicket detects settlements rather than collecting registrations: a transaction counts if it calls an EIP-3009 authorization function on the Arc USDC predeploy at 0x3600000000000000000000000000000000000000. The facilitator is the transaction sender. This means facilitators appear whether or not they have ever published anything about themselves.

As of 2026-09-25: 86,803 settlements indexed, 39 distinct facilitators, 7,281 USDC moved. Last 24 hours: 15,352 settlements across 10 facilitators. Indexed up to block 22,679,623.

Units and conventions used everywhere on this site and in the API:
- Amounts are integers in atomic USDC units, 6 decimals. 10000 = $0.01, 1000000 = $1.00. Never read them as dollars.
- Timestamps are Unix seconds in UTC.
- Addresses are lowercase hex, never checksummed.
- status 1 means the settlement succeeded, 0 means it was mined but reverted. Reverted rows are excluded from totals and volume.

## Docs

- [Overview](https://wicketworld.xyz/docs): what Wicket is, the quick facts table, and a first API call.
- [What is x402](https://wicketworld.xyz/docs/x402): the 402 to 200 flow, the role of a facilitator, and a glossary of every term used on the site.
- [API reference](https://wicketworld.xyz/docs/api): all four endpoints with parameters, response fields, pagination and examples.
- [Use our facilitator](https://wicketworld.xyz/docs/facilitator): how to point an x402 server at the Wicket facilitator — endpoints, the EIP-712 domain, error reasons, limits.
- [Methodology](https://wicketworld.xyz/docs/methodology): the exact detection rule, how aggregates are computed, and an explicit list of what this data cannot tell you.
- [FAQ](https://wicketworld.xyz/docs/faq): cost, labelling, reuse rights, and the state of the token.

## API

All endpoints are GET, return JSON, and send access-control-allow-origin: *. No authentication.

- [GET /api/stats](https://wicketworld.xyz/api/stats): network totals, 24h totals, indexer position. Compare indexedBlock between calls to detect a stalled indexer.
- [GET /api/leaderboard](https://wicketworld.xyz/api/leaderboard): every facilitator ranked by successful settles, with all-time and 24h figures. Complete list, no pagination.
- [GET /api/settles](https://wicketworld.xyz/api/settles): settlement feed, newest first. Parameters: limit (1-200, default 25), range (24h|7d|all, default 7d), facilitator (address), address (payer or payee), min (0|100|10000|1000000), before (block cursor for pagination). Invalid parameters silently fall back to defaults.
- [GET /api/search?q=](https://wicketworld.xyz/api/search?q=arcus): resolve a transaction hash, an address, or a facilitator name into site paths.
- [OpenAPI 3.1 specification](https://wicketworld.xyz/api/openapi.json): machine-readable description of the four endpoints above.

## Settling a payment through Wicket

Wicket runs its own x402 v2 facilitator at https://facilitator.wicketworld.xyz. Scheme "exact", asset USDC, Arc mainnet (eip155:5042) and Arc testnet (eip155:5042002). There is no fee, no account and no API key: sign an EIP-3009 authorization and the facilitator broadcasts it and pays the gas.

- GET /supported — networks and schemes served, plus the signer address.
- POST /verify — validate an authorization and reserve its nonce. Always call this before delivering anything.
- POST /settle — broadcast transferWithAuthorization, wait for confirmations, return the transaction hash.
- GET /healthz — hot wallet balance, today's remaining gas budget, authorizations in flight. Returns 503 when the facilitator cannot serve.
- GET /meta — the required extra block, the value floor and the per-payer cap.

PaymentRequirements.extra must be exactly {"assetTransferMethod":"eip3009","name":"USDC","version":"2"}. The EIP-712 domain name on Arc is "USDC", not "USD Coin". Several x402 SDKs default to "USD Coin" because it is correct on other chains; using it here makes the signature recover to a different address with no error message. Verify against DOMAIN_SEPARATOR() on 0x3600000000000000000000000000000000000000, which returns 0x940506929bba468048a19b567f4f0d534714bc06604b5c3017e5d16785ccdf84 on mainnet.

Limits, all published live at /meta and /healthz rather than discovered from a rejection: a minimum payment on mainnet, a cap on settlements per payer per UTC day, and a ceiling on gas spent per UTC day. Refusals return a standard x402 error reason plus a non-standard wicketReason field naming the actual cause (below_minimum, payer_daily_limit, daily_budget_exhausted). This is a deliberately small operation: read /healthz before depending on it for volume.

Four of the five attacks described in arXiv 2605.11781 and 2605.30998 are closed, each with a test that reproduces the attack. Settlement preemption is NOT closed, because closing it requires a wrapper contract and would break compatibility with every existing x402 SDK. That is stated on https://wicketworld.xyz/facilitator rather than omitted.

## Pages

- [The Wicket facilitator](https://wicketworld.xyz/facilitator): live wallet balance, remaining daily budget, every limit with its reasoning, and the full list of which attacks are closed and which is not.
- [Explorer](https://wicketworld.xyz/explorer): live feed, hour-by-day heatmap, value scatter, facilitator share over time, and who-pays-whom pairs. Filters live in the URL (range, f, min) so any view can be shared as a link.
- [Facilitators](https://wicketworld.xyz/facilitators): the full ranking table.
- [Facilitator detail](https://wicketworld.xyz/f/0xe074bf7f0aa27642059e6fcc40688b61d8265b49): per-wallet history, daily activity and top counterparties.
- [Transaction detail](https://wicketworld.xyz/tx/): one settlement, by hash.
- [Address detail](https://wicketworld.xyz/a/): what an address paid, received, and which facilitators carried it.

## Limits worth stating

- Wicket sees the on-chain half of x402 only. The HTTP request, the 402 response and the retry happen between servers and are not observable from any chain, so a settlement does not prove an HTTP 402 preceded it.
- What was purchased is never on chain.
- A facilitator is a wallet, not a company. One operator may run several.
- Payments settled off chain are not indexed. Plain ERC-20 transfer() calls are deliberately excluded.
- Arc mainnet and Arc USDC only. x402 on other chains is out of scope.
- A small number of wallets dominate the row count while a different, smaller set dominates value. Use the min filter before drawing conclusions from totals.

## Project

- Independent project. Not affiliated with Circle, although Circle operates Arc and runs one of the indexed facilitators.
- Data is public chain data, reusable under CC BY 4.0 with attribution to wicketworld.xyz.
- X account: https://x.com/wicketprotocol
- $WICKET is live on Arc at 0x06E0Ec452120316fcb0240a20aA461e0a1A7b329 (launched on Argus, no presale, no team allocation, liquidity locked at creation). That address is published on wicketworld.xyz and on https://x.com/wicketprotocol and nowhere else; any other contract using this name is not ours.