Verifiable AI on a sovereign Cosmos L1·open source·fixed-supply token
Documentation

Verifiable AI inference, explained.

Dendra is a sovereign Cosmos-SDK L1 where consumer GPUs serve AI inference, paid in a fixed-supply token — and every answer is economically verifiable on-chain: a cheating miner is slashed. This is the honest, technical version. Canonical source: the litepaper.

Overview

A client submits an end-to-end-encrypted prompt; the chain escrows a fee and assigns a miner through an unpredictable decentralized-VRF seed; the miner runs the model locally on its GPU and is paid optimistically; a sampled fraction of jobs is re-checked by a fresh committee with an LLM-as-judge, and cheating is slashed — all settled in a fixed-supply, zero-inflation token. Consensus is CometBFT BFT; miners are not validators, so owning a GPU never secures consensus. The novelty is the useful-work market layered on top.

The one differentiator. Its single unique property is verifiability: an answer you can re-check, and a miner that gets slashed on-chain for cheating. No closed API offers that.

How a request flows

Any OpenAI-compatible client points at the Dendra gateway (/v1/chat/completions) and uses the network without changing anything. The chain never sees your content — only a hash and metadata.

01

Encrypted request & escrow

The client encrypts the prompt to the miner's key and sends it through the gateway, which screens for illegal content and locks the fee in a module account. Pricing is pay-per-token: fee = base + per_token × (in + out).

02

Unpredictable assignment

An on-chain ECVRF beacon (aggregated via ABCI++ vote-extensions, bound to the block hash) fixes the assignment seed. The requester can't grind the job id to pick a complicit miner, and splitting stake across identities doesn't help (anti-Sybil).

03

Confidential inference

The assigned miner decrypts in RAM, runs the local LLM (via Ollama), anchors a commit on-chain, and is paid optimistically. Plaintext exists only in memory during compute, behind sealed-memory and egress guards.

04

Sampled audit & slash

After the commit, the VRF seed decides whether the job is audited (~10%). On an audited job a fresh committee re-judges the answer with a pinned LLM; a wrong — or silent — miner is slashed hard on-chain.

Verification — optimistic, LLM-as-judge

LLM output is non-deterministic, so byte-equality verification fails. Dendra uses an optimistic model (ADR-025/026/028): pay fast, then re-check a random sample with a fresh committee and an LLM-as-judge.

  • k=1Paid optimistically. A single stake-weighted primary miner answers and is paid provisionally on auditable jobs. Cost falls from ~3× to ~1×; latency is one inference, which unblocks streaming and larger models.
  • ~10%VRF-sampled audit. The seed is posted after the commit via H(seed ‖ jobId) mod 10000 < audit_sample_bps — the miner can't know in advance whether it will be checked.
  • judgeFresh committee + LLM-as-judge. On an audited job, the primary reveals to a fresh committee (excluding itself); each member runs a pinned LLM-as-judge and commits a binary verdict. A stake-weighted majority decides.
  • slashHard slash, clawback, appeal. Proven divergence → the provisional payment is clawed back and the stake slashed (~80%). A miner that stays silent is slashed too (no evasion). An honest miner merely offline can reveal late within an appeal window and recover. No slash below a verdict quorum (anti false-positive).
Why sampling helps. Auditing only ~10% of jobs makes a costly LLM-judge affordable — a budget an always-on committee could never fund — so detection quality rises and total cost falls at once. The earlier cosine-of-embeddings judge is retired: it accepted both keyword-salad and fluent-but-false answers.

Confidentiality — stated honestly

default Standard (Mode A)

End-to-end encrypted client↔miner (X25519 ECDH + AES-256-GCM). Nothing in clear at the relay or on-chain. The miner decrypts in RAM to compute, guarded by sealed memory, egress/disk guards, attestation and slashing — strong, detectable deterrence, not a cryptographic guarantee against a determined host.

opt-in Datacenter tier

On datacenter GPUs (NVIDIA Hopper / Blackwell), inference can run inside a hardware secure enclave for cryptographic confidentiality — an opt-in tier for regulated workloads.

Tokenomics — $DNDR (v5)

A fixed-supply utility token: the medium for paying for inference and rewarding miners. No mint, ever — rewards are released from a pre-allocated Reserve.

PropertyValue
Max supply10,000,000 DNDR — hard cap, zero inflation, zero mint
Base unitudndr — 1 DNDR = 1,000,000 udndr
Genesis allocationCommunity 35% · Reserve 33% · Treasury 27% · Team 5%
EmissionRelease of the Reserve, decreasing 22%/yr of the remainder — never minted
Emission flowswork (demand-gated 1.5×) · availability (4h slashable challenge) · security
Burn5% of fees (soft deflation → ~8.1M at 10y)
Protocol cut15% of a job (split: validators 50% / dev 20% / treasury 30%)

Custom modules hold no mint permission, and the standard mint module is neutralised by zero inflation. A 4,000-run Monte-Carlo keeps supply ≤ 10M in 100% of runs — structural, because emission only releases the Reserve. The demand counter that gates the work subsidy is a settlement-volume proxy, not a measure of external traction.

Run a miner

Mode A targets consumer hardware — an RTX-class GPU running a local ~8B LLM through Ollama. You're paid from real job fees; honest work is rewarded, lazy or wrong work is slashed. A one-command launcher brings up a devnet miner.

# spin up a miner on a consumer GPU · code & docs in the repo
curl -fsSL https://dendranetwork.com/miner | sh
  • GPUConsumer NVIDIA GPU (e.g. RTX-class). Enough VRAM to hold an ~8B model through Ollama; larger VRAM lets you serve larger models and earn more.
  • bondBonded stake. A miner posts real $DNDR as a bond. Correct work is paid; a wrong or silent answer drawn at audit is slashed — so the bond is your skin in the game.
  • netOpen network. A public, multi-operator network anyone can join — hardware requirements and payouts scale with it.

Security model — what secures the network

What secures it

  • BFT consensus for ordering and finality (standard CometBFT assumptions).
  • The economic verdict for correctness — up to an honest majority of the committee's stake.
  • Real bonds and real slashing: lying costs actual value on-chain.
  • Decentralized VRF randomness, demonstrated across two physical machines.

Confidentiality

  • End-to-end encrypted client↔miner; the chain and relay never see your prompt.
  • The miner decrypts in memory, guarded by sealed memory, attestation and slashing.
  • A datacenter tier adds a hardware secure enclave for regulated workloads.
  • Least-privilege permissions — no module can mint.
Proven on-chain. Hard slashing is proven live: a cheating miner loses up to ~99% of its stake automatically, a silent one ~80%, with zero honest miners penalized.

Status & roadmap

Live: the full inference round trip end to end, the on-chain economy in real coins (emission, bonds, slashing, burn, pools), E2E encryption, replay-safe settlement, decentralized VRF across two machines, on-chain miner-key anchoring, and secure-by-default settings.

  • nowPublic app & testnet. Illegal-content filtering at the gateway, a replayable on-chain slash powering “The Proof”, a public incentivized testnet, an OpenAI-compatible chat, and monetization with buy & burn on real revenue.
  • nextCommunity GPUs & scale. One-click miners, throughput measured on a real multi-validator network, a broad cross-hardware operator set.
  • laterBusiness & mainnet. A hardware-isolated privacy tier; image generation stays gated behind a verification design. Mainnet ships when it's right — no date promised.