Digital goods · paid in USDC on Base · no account, no email
Code that already works, instead of 20 hours of glue.
Three small, tested kits for people who build on-chain: a holder-forensics CLI,
a USDC paywall for static sites, and an alert bot. Each one exists because we needed it
ourselves and shipped it. Every claim below is a command you can run.
3products, one price each
0accounts, cookies, analytics
4Base RPCs checked per payment
~60sfrom tx confirmation to download
MITLite versions, no strings
Featured Code & Digital Goods
Prices are flat, one-time, in USDC on Base. The Lite version of each is free and public on GitHub — buy the Pro pack only if the extra commands save you a day.
Python · CLIBase + Solana
Token Holder Forensics Kit
Who actually holds this token, where the liquidity sits, and which wallets bought first.
$19 USDC
Rebuild holders from raw Transfer logs — no explorer API, no key
Pick a product, send the exact amount of USDC on Base to the address below, paste the transaction hash. The page reads the receipt from a public RPC and checks the Transfer log itself — amount and recipient. Nothing is stored, nothing is emailed.
0x72Aa6edDE71B94f6b99c8e52EdC02B5C75F74d1a
19.00 USDC
Wrong chain, exchange withdrawal, or paid from a smart account? Every one of those produces a hash that does not contain a USDC transfer to us — the page will say so instead of pretending. Open an issue with the hash and we resolve it by hand.
How delivery works (and where it is weak)
01
You send USDC on Base to a single address. No invoice, no account.
02
You paste the hash. The page fetches the receipt from four public Base RPCs until one answers.
03
It decodes the receipt's logs: a Transfer from native USDC, to our address, for at least the price.
04
On success it reveals the archive link and its AES-256 passphrase.
The honest part
A static page cannot enforce a licence. The Pro archive is encrypted with AES-256-CBC (PBKDF2, 200k iterations) and the passphrase is only shown after a verified payment — but the passphrase lives in the page's JavaScript, so someone who reads the source can decrypt it without paying. We say this out loud instead of calling it DRM.
If you need real access control: open an issue with your transaction hash and we add you to a private repository. That is manual, it is slower, and it is the only version that actually holds.
Free and Lite versions
Open source, MIT, no signup. If the Lite version is enough for you, use it — that is a valid outcome.
Kit
Free / Lite includes
Pro adds
Repo
Forensics
Holder census from raw logs, concentration metrics, HTML report (EVM)
Numbers on this page come from runs we can repeat. If a number rots, the page is wrong and we fix it.
The payment verifier runs in the browser and in Node from the same file, so the code that unlocks the page is the code under test.
Its test suite executes against a real Base mainnet transaction; the fixture's recipient and amount are read from the chain, so it fails loudly if the fixture stops being a USDC transfer.
Every kit ships a live check that hits the public endpoints it depends on, and prints PASS/FAIL per check.
The DefiLlama audit behind this site is method + caveats, with the raw CSVs public — including the part where 10 of 10 hand-checked "broken" adapters were correct.
Who this is
A one-person workshop that ships small tools and writes down what broke. The storefront is a static page on GitHub Pages; the checkout is a few hundred lines of JavaScript; the only network calls it makes are JSON-RPC reads to Base, and only after you press verify. No cookies, no analytics, no third-party fonts.