DocsMore

Trust model

What the code enforces, what is only declared, and what each party has to trust. Read this before you rely on a number shown by the app or send supply into a dropper.

Enforced by the dropper contract#

Guarantee	Mechanism
Only the executor can pay out	`kapnij` checks `msg.sender == wykonawca`
At most `maksNaEpoke` per epoch, however many batches	the cap applies to the running sum of the epoch
Epochs cannot open faster than `minOdstep`	timestamp check on `epokaId == epoka + 1`; a zero interval is impossible
A closed epoch takes no more batches	`domknieta`
The owner can stop drops instantly	`ustawPauze(true)`
The owner can always get the funds out	`wyplac` has no condition other than ownership; it works while paused and mid-epoch
The dropper cannot become ownerless	`renounceOwnership` reverts
One dropper, one token	`token` is immutable and must have code
Every batch leaves a trace	`Kropla(epoch, count, sum, listHash, rulesHash, closed)` before any transfer; the list is in the calldata

Worst case per day from a hostile or compromised executor: maksNaEpoke × (floor(86400 / minOdstep) + 1), and never more than the balance.

Enforced by the registry#

Only the live owner() of a dropper can change its rules or logo. Ownership is two-step; after a transfer the old owner's rights end immediately.
Logos are https:// or ipfs:// only, at most 256 bytes.
The registry holds no tokens and has no path to move any.

Declared, not enforced#

Declaration	Who reads it	Why it cannot be enforced
The split rules (`Reguly`)	the keeper and anyone auditing a drop	the dropper cannot see holding periods; the list is built off chain. Rules are a public commitment that lets everyone recompute the list and compare it with what was paid
The quiet period (`okresBezruchu`)	the coin page, next to the measured last transfer	no contract can tell whether a token has been trading; the withdrawal must stay unconditional to remain an emergency exit
Symbol, name, logo	humans	the registry is permissionless; two coins can share `$ABC`. The app never says "verified". Compare addresses

Nothing in plop promises a wallet an amount. The coin page says who qualifies and what the split would be at the snapshot block; the actual drop depends on who still qualifies when the keeper snapshots.

What each party trusts#

A holder#

The creator, who can withdraw the remaining supply at any time, pause, or change the rules with one transaction. The app shows every such change (ZmianaRegul, Wyplata, Wstrzymanie) and the balance live.
The executor, within the cap and interval. A hostile executor can send an unfair list; it cannot exceed the cap. Every drop can be audited after the fact from skrotListy, skrotRegul and the calldata; see Reading the data.
The snapshot. Qualification is only as good as the holder index. When the index has a gap (pelna: false), the keeper refuses to send and the app says the list is incomplete.

A creator#

The executor key, to the extent of the cap per day. Choose maksNaEpoke and minOdstep as a loss you can survive. If the key leaks, ustawPauze(true) or ustaw(newExecutor, …) stops it in one transaction.
The token. A fee-on-transfer or rebasing token makes intended and delivered amounts differ. The dropper records intended amounts and reads its balance live; it does not correct for the difference.

An integrator#

Addresses, not names. The dropper address is the identity of a coin; poTokenie lists all droppers of a token.
Block-header time. Never use log blockTimestamp on this chain and never compare a snapshot against a later clock.
Rules can change between your read and the drop. Pin reads to a block, and re-read wpis/ZmianaRegul before you present a list as "the next drop".

Keys#

Key	Where it should live	Holds
Dropper owner	hardware wallet or multisig	authority over rules, cap, pause, withdrawal
Executor	a hot wallet on the keeper host, in `WYKONAWCA_KLUCZ` only	ETH for gas; never the token
RPC endpoint	server-side `RPC_URL` only	a paid archive endpoint is an access key in itself

The keeper refuses to start when a key-like value sits in any NEXT_PUBLIC_* variable, and it cannot read keys from files.

Known limits#

Rules are the executor's promise, not the dropper's. A manual exclusion list (wykluczone) is keeper-side; a rules hash that differs from what you compute from the registry alone may be due to such exclusions. Compare the lists, not only the hashes.
No reorg protection. A single sequencer with first-come-first-served ordering makes reorgs unlikely; the holder index has a marginBloki option, default 0.
Snapshot cache has no lock. Two concurrent scans of the same token on one server may write duplicate lines; duplicates are dropped on read. The API coalesces concurrent requests to avoid it.
Rate limits are per process. Multiple app instances multiply the /api/rpc budget.
The chain's RPC. The public endpoint answers 429 after a few consecutive eth_getLogs; the app and keeper back off, but a heavy third-party indexer should run its own node or use an archive provider.