Pigeonhole’s invoice flow uses CREATE2 to publish a USDC deposit address before deploying any contract there. In Edy Cu’s account, that address has no private key; when a payer sends Arc’s native USDC to it, a small contract can later sweep the balance to a treasury. The design nearly failed for a less obvious reason: the app inferred payment status from transfer logs, and its first full-history query exceeded the public RPC’s reported range limit. A paid invoice could therefore still appear as UNPAID.
How can a USDC deposit address have no private key?
A blockchain address does not need a private key to receive funds. The key question is whether someone can cause assets at that address to move. Pigeonhole’s design separates receiving from spending: an invoice gets a predictable address first, and a factory later deploys code there to forward its balance.
As an Amazon Associate I earn from qualifying purchases.
Predicting an address before deployment
According to Edy Cu’s account, Pigeonhole hashes each invoice ID into a CREATE2 salt. The factory combines that salt with its own address and the init code for a tiny forwarding contract to predict the deposit address. The predicted address can be shown to a payer before a contract is deployed there. Cu describes the address at that point as having no key, code, or nonce.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →This is a deterministic address, not an account whose private key has been lost or hidden. Its address is derived from deployment inputs; control of funds depends on the later contract deployment and its behavior. The factory embeds an immutable treasury as the recipient.
#1 Best Overall
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Sweeping the balance
When someone calls the sweep function, the factory deploys the throwaway contract at the predicted address using CREATE2. Its constructor executes the runtime behavior Cu describes as PUSH20 treasury; SELFDESTRUCT, transferring the address’s balance to the treasury. Cu cites EIP-6780 to explain why an account created and self-destructed in the same transaction is deleted again, allowing the address to be reused.
This description is specific to Pigeonhole’s stated Arc setup: Cu says Arc uses USDC as its native balance, so a plain native-value transfer can fund the address and be moved by this pattern. It should not be generalized to ordinary ERC-20 USDC on other EVM chains. Cu says an ERC-20 token balance cannot be swept this way with SELFDESTRUCT; the token is tracked by the token contract rather than held as the address’s native balance.
Rank #2
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Why did a paid invoice risk showing UNPAID?
Pigeonhole has no database in Cu’s description. Its page infers state from Arc transfer logs: an incoming Transfer log from Arc’s system emitter to the deposit address means PAID, while an outgoing transfer from that address that reduces its balance to zero means SWEPT. That makes log retrieval part of the payment interface’s correctness, not merely a convenient read.
The first version asked eth_getLogs for the entire history in one call. Cu reports measuring the public Arc RPC on 17 September 2026: a span of 9,999 blocks succeeded, while a span of 10,000 failed with error -32012 requested range too large. At the roughly two blocks per second Cu used for the estimate, 9,999 blocks represented about 85 minutes. This is a measurement of that RPC at that time, not a universal or permanent EVM rule.
Rank #3
- Compact and Convenient: Experience the power of security in the palm of your hand with a credit card-sized design that combines portability and convenience.
- Biometric Fingerprint Authentication: Elevate your security to new heights with advanced biometric fingerprint authentication. This cutting-edge technology adds an impenetrable layer, ensuring resilience against unauthorized access. Your assets are safeguarded like never before.
- Encrypted Bluetooth Connection: Stay connected with confidence through an encrypted Bluetooth connection, providing a secure link between your hardware wallet and your devices.
- Ultimate Security Certification: Rest easy knowing your assets are protected by the highest standards. SecuX Shield is certified CC EAL5+, featuring the Infineon Solid Flash CC EAL5+ Secure Element (SE) chip embedded for ultimate security.
- Hands-on Clear-sign: Take control with a clear-view display of transaction details. Hands-on device authorization ensures a seamless and transparent user experience.
Once the factory’s history extended beyond the accepted range, a full-history refresh could fail. Since the page relied on those logs to decide whether an invoice was paid, missing the relevant event could leave a genuinely paid invoice displayed as UNPAID. As Cu puts it, “Log queries are not views.” A read-only request can still have provider-specific limits and operational consequences.
How the scan was changed to stay within the RPC limit
Cu says the implementation now limits each log scan to 9,000 blocks—below the measured 9,999-block ceiling—and reads history in sequential chunks. The described approach also combines pacing and retries, incremental polling, and local checkpoints so a returning visitor need not fetch already completed chunks again.
Rank #4
- Securely backup seed phrase of your bitcoin & cryptocurrency hardware and software wallets, (compatible with Ledger, Trezor, Trust Wallet, Bitbox, KeepKey, MetaMask, Coinbase Wallet, Mycelium, Exodus, Wasabi Wallet, Keystone, Onekey...)
- Made of 304-grade indestructible stainless steel, fireproof, waterproof, anti-corrosion, and anti-destruction, your seed words are always protected and Internet isolated.
- Compatible with all BIP39 hardware and software wallets, supports 12, 18, 24 mnemonic seed phrase (only first 4 letters needed). A total of 288 letters are provided. Support unlimited cryptocurrencies (Bitcoin, Ethereum, Polygon, Ripple, Shiba, Litecoin, Dogecoin, Cardano, Binance, Avalanche, Solana, USDC, USDT ...)
- 100% Offline, no WIFI, no bluetooth, the safest way to store mnemonic seed phrase, never have to worry about being hacked.
- Very convenient to use, anyone can install it easily to store seed phrase safely. It also can be locked with the hole in the product.
Chunking and resuming history
- Keep each range below the observed cap: the selected maximum span is 9,000 blocks, rather than relying on a request at the provider’s boundary.
- Tile the requested history sequentially: successive ranges cover the start-to-end interval without gaps.
- Resume completed work: completed chunks are checkpointed in localStorage.
- Poll forward incrementally: later checks request newer history instead of rescanning everything on every refresh.
- Deduplicate overlap: logs are keyed by transaction hash and log index so overlapping polls do not count the same event twice.
- Give old invoice links a start hint: a
?from=URL parameter carries the invoice creation block so the scan can begin closer to the relevant event.
The project checks Cu reports include tests intended to keep every chunk below 10,000 blocks, tile a range without gaps, fetch a 250,000-block history without the range error, and avoid double-counting overlapping polls. These are the author’s reported project tests, not independent verification of the implementation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What the reported measurements do—and do not—show
Cu reports a median sweep cost of 64,162 gas across 25 benchmark rows and estimates that as about $0.0013 at Arc’s stated 20 Gwei floor. He also reports sustaining approximately 0.5 eth_getLogs calls per second against an anonymous Arc RPC. These numbers describe the author’s measurements and stated assumptions; they are not guaranteed costs or service levels for other RPC providers or times.
Best Value
- Ultimate Security: Certified CC EAL5+. Infineon Solid Flash CC EAL5+ Secure Element (SE) chip embedded
- Offline and Unhackable: Store your private key offline away from hacking threats and phishing attacks.
- Hands-on Clear-sign: Clear-view display of transaction details. Hands-on device authorization
- PIN protected: Dynamic keypad for PIN entry. Automatic reset after 5 unsuccessful PIN entries
- Intuitive Color Touchscreen: 2.8 inch large touch screen allows secure, easy and instant verification
The scan start hint matters for older links. Cu estimates that an old invoice URL without ?from= would require about 38 log calls per day of chain at the measured RPC rate, and says the first read can take minutes. PAID latency was not benchmarked, so the scan measurements do not establish how quickly a payment will appear on the page.
Cu reports 12 Foundry tests, 25 Vitest tests including 20,000 fast-check property cases, and 34 read-only Playwright checks against mainnet. He also says an offline CREATE2 check compared 50 random IDs with on-chain predict(). These counts describe checks reported by the project author, not an independent contract audit or reproduction of results.
Trade-offs to understand before using this pattern
- Chain-specific asset behavior: the sweep mechanism relies on the Arc native-USDC behavior Cu describes; it is not a general recipe for ERC-20 deposits on other EVM networks.
- Fixed treasury: the factory’s treasury is immutable, so changing the beneficiary requires a new factory, according to Cu.
- RPC dependency: public RPC availability, throughput, and range limits affect whether the page can reconstruct invoice state from logs.
- History cost in time: a link without a creation-block hint may require scanning much older history; chunking makes that possible within the measured range limit but does not make the work instantaneous.
- Browser scanning versus indexing: the described design reads logs client-side and checkpoints locally. A maintained indexer or backend would be a different architectural choice; the article does not establish comparative performance or reliability for those alternatives.
Cu says the explorer API presented a challenge page and the factory source was not verified there. He reports that the on-chain runtime matched forge build output by a truncated keccak hash. That is a reported comparison, not the same as a publicly verified source or independent audit. He identifies the factory as deployed on Arc mainnet, chain 5042, at 0x942b8c102e73aeea1a652ebC8F2d319fD08D9A40; the address and related transaction evidence are pointers from his article and have not been independently checked here.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
