Payd Protocol
Where this launch's fees go
fixed at creation, never raisableThe basket
Your stocks
Reading the chain…
How it workseverything below is verifiable on-chain by anyone
Every trade on the token pays the curve fee plus the tax the creator set at launch. Part of it reaches the vault — the tax in full, plus the share of the curve fee Pons does not keep. Anyone can trigger the collection.
A purchase covers every epoch since the last one and buys all the stocks at once, each by its weight. The price floor comes from a 30-minute on-chain TWAP, tightened by Chainlink when the feed is fresh — and a leg that cannot be bought is skipped rather than reverting the rest.
Your share is pro-rata to what you hold, weighted by how long you hold it across the whole epoch — the area under your balance, not a photograph. Nobody picks an instant, because no instant is picked.
Shares accumulate. Once yours are worth about $10, they are sent to your wallet automatically, at most every 24 h. Below that they keep adding up — or you collect them whenever you want.
A transfer costs gas whatever it carries. Delivering a $0.20 share would burn half of it. Waiting until it is worth about $10 means you keep 99 % of it instead of 90 %. Nothing is withheld — only batched. If gas ever gets so expensive that $10 would leave you less than 95 %, the threshold rises instead of your share shrinking.
One address publishes the shares, and it takes effect immediately — that is what makes payouts instant. It cannot invent money: the contract never pays out more than it received, and never pays the same share twice. Its exposure is shown above as at risk right now. Anyone can recompute a published root from chain data alone and prove a discrepancy.
Settlement details
Amounts are cumulative: one claim settles the whole history, one transfer per stock, no matter how much time has passed. Replaying an old proof pays nothing. Epoch data is fetched from a gateway and then checked against the digest published on-chain — a gateway serving anything else is rejected.
Vault
anyone can call every stepNext payout
one purchase buys the whole basket — your share followsRecent epochs
| Epoch | Stock funded | Blocks with a transfer | Status |
|---|
Recent pushes
What was delivered, which is a different question from what was bought above.
One row per distribute call: a wallet past the ~$10 floor gets every line it is
owed in a single transaction. Below the floor nothing is lost — it accrues, and
claim stays open.
| When | Wallet | Lines | Delivered | Tx |
|---|
Protocol stats
Where the money goes
immutable constants, no setterSplit of everything the vault collects. These are fractions of what arrives, not points of volume: if the effective fee rate moves, the three lines shrink proportionally and none is privileged.
The basket, stock by stock
weights changeable by timelock only| Stock | Weight | Pool | Price floor | Bought | Distributed | Claimed |
|---|
The active root
Eligibility
The threshold is expressed as the value of the share, not as a
percentage of supply, and its denominator is the ETH collected since genesis. It
falls on its own as fees come in, and never rises again. The rule is a pure
function in offchain/src/eligibility.ts — anyone replays it.
Parameters
read from the deployed contracts, not hardcoded here1 — The cycle
An epoch lasts 30 minutes. A purchase covers every epoch that has closed since the last one — a window — and buys the whole basket at once, each line by its weight. So a holder receives a slice of the basket, not whatever a wheel happened to land on.
Every step below is callable by anyone — except
publishRoot, see §4 — and refunds its own gas at the real cost, priced at
block.basefee, which the caller does not choose.
harvest() collect the creator fees, split platform / rewards / creator
buyBasket(minOuts[]) buy the WHOLE basket for every epoch since the last purchase,
each leg above the 30-min TWAP floor
publishRoot(...) publish the cumulative root + data CID (keeper only)
claim() / distribute(...) settle, one transfer per distinct stock
collect(...) the same, across several launches in one transaction
2 — Who is owed what
An epoch's snapshot is the time-weighted average of balances over the whole epoch — the integral of your balance divided by the epoch's length, not a sample. Hold for the full period and you weigh what you hold; hold for a second and you weigh a second. The period is two immutables and a subtraction, so nobody picks any part of it, and there is no seed to commit and no draw to trust.
A threshold drops shares that are not worth their place in the tree. It is expressed as the value of the share, never as a percentage of supply — a fixed percentage is too permissive at launch and too restrictive later:
eligible if balance / candidateSupply * quoteCumulative >= MIN_SHARE_WEI
The denominator is the ETH collected since genesis, not the epoch's. The threshold therefore does not depend on how time is sliced, and changing the epoch length never silently redefines who is owed what.
Excluded from the snapshot: the Uniswap pool, the bonding curve, the vault, the distributor, the zero address, and a timelock-managed list of addresses. An exclusion takes effect at the next epoch and is dated in the log, so two honest verifiers never disagree about which set applied. A share once earned is earned for good.
3 — Receiving your shares
Airdrop. Pushed without asking, as soon as the share is worth at least ten times its delivery cost. The pusher is refunded only against the push root, so pushing dust is never profitable — and never drains the reserve.
Claim. No threshold, no condition, from the moment a root is published. The threshold decides who gets delivered for free, never who is owed.
Either way, amounts are cumulative: each new root replaces the last and carries the whole history. One claim settles everything, with one transfer per distinct stock — never one per epoch. A holder away for a month is served in as many transfers as the basket has lines — five today — and that number never grows.
4 — Verify for yourself
Roots are published by a single address, the keeper, and take effect
immediately — that is what makes payouts fast. There is no bond and no challenge
window: the guarantee is not that someone would object in time, it is that the
contract caps what a wrong root can do. It can never pay out more than was funded,
never pay the same share twice, and never take back what was already delivered. The
exact exposure at any instant is public: quoteAtRisk().
Before every publication the keeper runs five checks — conservation, monotonicity, population, provenance, and a full recomputation from a second independent node — and refuses to publish if any of them fails. Anyone can redo that recomputation:
DISTRIBUTOR=0x… FEE_VAULT=0x… pnpm --filter offchain dispute <rootId>
It runs read-only, with no key at all, against the public RPC — the
snapshot replays Transfer events instead of querying historical state, so
no archive node is needed. A divergence is a reproducible proof anyone else can
reproduce in turn.
5 — What this page verifies
yes The integrity of the published data. The contract publishes the sha256 of the canonical JSON. This page fetches the file through a gateway, recomputes the hash and compares. A hostile gateway can only make the page unusable — never falsify an amount or an address.
no The computation itself. Replaying the
transfer history in a browser would be slow and brittle. That is what
dispute.ts is for — and that distinction is what to know, rather than
believing the page “verifies everything”.
6 — The keys
One single authority: a timelock whose proposals come from a Safe multisig and whose execution is open to anyone once the delay has passed — so nobody can hold a decision already made hostage.
can reweight the basket or replace a stock · set the payout rate per purchase, within bounds · size the gas reserve, within bounds · change the snapshot exclusion list · rotate the keeper key.
cannot withdraw funds or change where they go — no
privileged withdrawal exists, the only withdraw() refunds a caller
their own failed payment · freeze distribution — the payout floor prevents it by
construction.
7 — Risks, unvarnished
Robinhood stock tokens are conditionally transferable. If the distributor is blocked on one stock, that stock can no longer leave — irreducible at the token level. The other lines keep going, and the right stays written in the root.
Below the threshold a holder is not in that epoch's tree, and their weight is redistributed to the others. There is no retroactive catch-up: the loss is bounded by the threshold itself, by construction.
Pons imposes three days of timelock, then a three-day execution window. Replacing the vault is not an instant operation — which is exactly why it is the simplest contract in the system.
Time-weighting means a minute held is paid as a minute — it makes sniping worthless, but long-term alignment is not what this design buys.