◆ onchain.wick.picsbuild notes & roadmap
What this is
onchain.wick.pics is the umbrella for a suite of on-chain / agent-native products. Product #1 is live: a multi-chain token-safety checker — paste a token address, get a scam/safe verdict for PulseChain · Monad · Base · BSC. The strategic edge is the long-tail chains the incumbents (GoPlus etc.) barely cover, sold across three tiers (human → power-user → autonomous agent). ● LIVE
The three tiers
Free LIVE
humans · $0
- Web checker + shareable verdict links
GET /api/v1/check- 40 checks/hr per IP, standard depth
- Viral front door + trust-builder
Paid LIVE
power users · API key
- No rate limits + batch
- Deep multi-DEX / V3 liquidity
- Monitoring + webhook alerts
- Reliability-hardened
Auto LIVE
agents & protocols
- x402 pay-per-call (USDC/Base)
- MCP tool
check_token_safety - Bazaar-discoverable, no signup
- Embeddable safety gating
The free↔paid balance is deliberate: free gives a full, honest verdict (so it spreads and earns trust), but scale (API/batch/no-limits), depth (multi-DEX/V3 liquidity), and continuity (monitoring) require paying.
The engine — wick-safe/0.3
One call → { verdict, score 0-100, riskLevel, confidence, checks[], evidence }. Verdicts: SAFE / LOW_RISK / CAUTION / HIGH_RISK / LIKELY_RUG / NOT_A_TOKEN / UNKNOWN. It composes:
- Contract risk — mint / blacklist / pausable / tax-adjustable / proxy / owner-renounced, scored 0–10 from bytecode + selectors.
- Liquidity — deepest token/wrapped-native pool → USD depth. Free = the main V2 pool; paid = deep aggregate across all V2 forks + V3 + Solidly (Aerodrome).
- Honeypot — transfer simulation from the pool (revert = blacklist/honeypot signal).
- LP-burn — PulseChain only, from our burned-LP index.
- Known-rug + denylist — per-chain rug archive + infra-address filter.
Reliability guards (why the verdicts are trustworthy)
- Never false-confident. An RPC error never becomes a fake "NOT_A_TOKEN" — an unswallowed
getCode probe fails over to the next RPC instead.
- Multi-RPC round-robin + per-probe failover on the deep scan, so a throttling public RPC can't return "0 pools."
- Coverage-aware. Full coverage (PulseChain) penalizes low liquidity; partial-coverage chains treat a thin V2 reading as inconclusive, not a strike — no false flags on real tokens.
- No "SAFE" without USD-verified liquidity depth. Cache + serve-stale-on-error keeps the paid tier responsive when an RPC dies.
Chains & coverage
| Chain | id | coverage | notes |
|---|
| PulseChain | 369 | full | PulseX V1/V2 + 9mm + LP-burn index — our strongest |
| Monad | 143 | partial → deep | V2 forks + Uni-V3 + Algebra (paid deep) |
| Base | 8453 | partial → deep | BaseSwap V2 + Uni-V3 + Aerodrome (paid deep) |
| BSC | 56 | partial → deep | PancakeSwap V2/V3 (paid deep) |
Stack & deploy
- Node + Express, CommonJS, ethers v5 (matches the reused on-chain detection modules from the trading stack: contract-analyzer, denylist, token-gates + the burned-LP index).
- x402 via the dual-CJS
@x402 SDK; MCP via the official SDK (check_token_safety tool).
- Live at onchain.wick.pics through the Cloudflare tunnel → local service; supervised (auto-restart) via the wick.pics site-health cron.
Plan moving forward
Shipped (2026-05-29): the agent-data suite is live — Token Safety, Exit-Safety, Fresh-Rug Radar, Safe Smart-Money, Red-Team, On-chain Alpha Dataset — plus the WHAT TICKER? flagship ("which ticker are alpha wallets buying that also passes safety") and a $WICK-holding access gate (hold ≥ $500 of $WICK → unlock paid access). Each on free / paid-key / x402 tiers.
1 · Self-sovereign mainnet revenue (x402) — ~90%, one handshake bug left (2026-05-30). Going straight to Base mainnet on our own rail, no Coinbase — x402 is an open protocol, so we run our own facilitator and own our discovery (/.well-known/x402.json, not the Coinbase Bazaar). Done: in-process Node facilitator (lib/x402-facilitator.js) mounted on Base mainnet (eip155:8453), settler 0x640cEBC as signer, issuing a correct 402 challenge (USDC, $0.01, our payTo, EIP-712 domain "USD Coin"/2); demo-buyer funded with real USDC (2.012, tx 0x837ee720…, block 46652036); the autonomous buyer (scripts/x402-demo.js) gets the 402 and signs a valid EIP-3009 transferWithAuthorization. Blocker: @x402/express's processHTTPRequest re-challenges the paid request without reaching facilitator.verify (verify/settle hooks never fire) — i.e. the payment is rejected at the decode/scheme-match step, a v2 wire-format detail (the client's createPaymentPayload nests scheme/network under accepted). Next: read x402HTTPResourceServer.processHTTPRequest's decode/match path and align the X-PAYMENT shape — zero real-money risk; funds are safe in our own wallets, settlement never ran.
2 · Red-Team track record page (/redteam). Curate the critical-vulnerability investigations into efficient per-case dot-points (test categories → bugs found → responsible disclosure), including the Monetrix (Code4rena) submission. Source data: red-team/poc/monetrix-c4/ + logs/red-team/{bounties,assessments}.json + cases/.
3 · Keep expanding the suite — same engine + on-chain data moat, more agent/protocol products (free/paid/auto):
- Rug / LP early-warning alerts — watch your bags, webhook on LP-pull / owner action / dump. Recurring revenue; builds on the burned-LP index. next
- Pre-trade transaction simulation — "will this swap revert / what's the real tax / am I about to be sandwiched?" Reuses the honeypot sim + mempool sentinel. next
- Safety-scored new-launch feed — live launches per chain with the verdict pre-attached, for snipers/agents. next
- Portfolio risk x-ray — point at a wallet, get a verdict on every token it holds. Viral consumer front door. next
- Wallet / address reputation API — drainer / sybil / serial-rugger-deployer scoring. Reuses wallet-cluster classification.
- Cheap automated pre-audit — a low-cost contract red-flag report for teams priced out of full audits.
- The agent toolkit — bundle all of the above as MCP + x402 endpoints and become the default safety/data layer AI agents reach for. This is the moat: agent-native distribution the incumbents don't own.
4 · WHAT TICKER — from teaser to a real daily track record (blocked on data, 2026-05-30). Target: lock one pick/day (Monad first), archive every past pick, score each on its 24h/48h outcome — free = browse all past picks, paid/x402 = today's fresh pick. Honest blocker: five backtests on 38 days of real Monad signal data proved the current signals (cohort count, confidence, wallet-quality, 1h-momentum) do not predict pumps — count/quality cap at ~8% hitting +100%@24h and momentum is look-ahead bias. The only surviving edge candidate is EARLY-ENTRY (being in the first ~3 buyers alongside a proven-early wallet, pre-confirmation). Two capture daemons launched 2026-05-30 (launch-cohort-capture.js + forward-lattice.js) are accumulating the wide, correctly-priced dataset; day-14 validation decides whether a daily-2x framing is shippable. Do not ship the engine until it clears a strike-rate bar — until then WHAT TICKER stays a teaser. Pick-quality hardened (2026-05-31): the smart-money picker now denylists "plumbing" tokens alpha wallets touch that aren't real discovery — liquid-staked MON (aprMON = just staked MON, plus gMON / shMON / sMON / nWMON), wrapped majors (WBTC / WETH / wstETH / wSOL / WXRP) and stables (USDC / USDT) — so a surfaced pick is always a genuine tradeable token, not staking/routing noise. Real memecoins (GMONAD, EGG…) are deliberately kept eligible.
5 · Mempool-as-a-Service. Decoded pending-swap + competitor-intent stream as an x402 / MCP product (the "Mempool Stream — COOKING" tier). Monad's mempool is readable (86K pending swaps captured before) and PulseChain already has the sentinel feed; reuses existing infra. Build deferred until the focus products + the x402 rail (item 1) are closed.
Honest constraints
- Single-box infra. Verdict latency rises when the machine is loaded (it co-hosts the trading stack + ~80 daemons). Caching helps; real scale needs dedicated RPC / headroom.
- x402 is an emerging rail. Low volume in 2026 — this is a cheap, near-zero-maintenance call-option on the agent-payment economy, not a guaranteed near-term earner. The free human tier + paid API are the nearer-term revenue.
- Verdicts are informational. On-chain safety is never 100% certain — every response ships a no-warranty disclaimer.
WICK
Net profits from these products are used to buy $WICK. The products turn the trading stack's on-chain data moat (honeypot sim, burned-LP index, contract-risk, mempool sentinel) into recurring, low-touch USD — the lever that grows real dollars where the bots are execution-saturated.