Indexer Trust Model
What It Guarantees
Eventual Consistency
The indexer will eventually reflect all on-chain state changes.
There may be a delay between a transaction confirming and the indexer updating. During this window, the indexer may show stale data.
Deterministic Reconstruction
Given the same event log, any indexer instance will produce the same state.
Two independent indexers watching the same chain will converge to identical state.
Replayability
The indexer can be rebuilt from scratch by replaying historical events.
If the database is corrupted or lost, it can be reconstructed. No state is original to the indexer.
What It Cannot Do
Cause Payments
The indexer cannot trigger payments.
It can tell keepers "this subscription is due," but the keeper must submit a transaction, and the chain must validate it. If the indexer lies about what's due, the chain rejects invalid executions.
Bypass Authorization
The indexer cannot authorize payments that shouldn't happen.
Even if the indexer claims a subscription is active, the on-chain module rejects execution if the subscription is paused, expired, or already processed.
Settle Disputes
The indexer is not an authority on what happened.
The blockchain is the authority. If the indexer shows a payment that didn't happen (or vice versa), the chain is correct and the indexer is wrong.
Hold Funds
The indexer has no wallet, no keys, and no ability to move value.
It observes. It does not act.
What Breaks If It's Down
Keeper Execution Degrades
Keepers typically poll the indexer to find work. If the indexer is down, keepers cannot discover due subscriptions efficiently. Some payments may be delayed.
This is a liveness issue, not a safety issue. No incorrect payments occur.
Dashboards Go Blank
Merchant dashboards and user portals depend on indexed data. If the indexer is down, they show stale or no data.
This is a UX issue, not a correctness issue.
Retry Engine Stalls
The retry engine uses indexed failure history to schedule retries. If the indexer is down, failed payments may not be retried promptly.
What Does NOT Break
- Payment correctness
- Idempotency
- Authorization enforcement
- Fund safety
The system fails safe. Downtime affects convenience, not correctness.
Discoverability vs Correctness
This distinction is fundamental:
| Aspect | Discoverability | Correctness |
|---|---|---|
| Source | Indexer | Blockchain |
| Failure mode | Degraded UX | Impossible by design |
| Trust required | Convenience trust | Zero trust |
| Rebuild possible | Yes, from chain | N/A (is the source) |
The indexer handles discoverability. The blockchain handles correctness.
Confusing these leads to fear about "centralized infrastructure." The indexer is centralized infrastructure for convenience. Correctness is decentralized and trust-minimized.