Verifiable AI inference, explained.

Overview

A client submits an end-to-end-encrypted prompt; the chain escrows a fee and assigns a miner through an unpredictable decentralized-VRF seed; the miner runs the model locally on its GPU and is paid optimistically; a sampled fraction of jobs is re-checked by a fresh committee with an LLM-as-judge, and cheating is slashed — all settled in a fixed-supply, zero-inflation token. Consensus is CometBFT BFT; miners are not validators, so owning a GPU never secures consensus. The novelty is the useful-work market layered on top.

API quickstart — for integrators

Dendra is a drop-in OpenAI API: no custom SDK. Any OpenAI client works — only base_url changes — and a response served by a miner additionally carries a dendra proof block your code can act on. The gateway lives on api.dendranetwork.com; self-hosters point base_url at their own gateway instead.

Calls that return real data right now. These are reads, not inference, so they do not depend on a miner. Copy them as-is to confirm your network path reaches the chain and the gateway.

2 · What Dendra adds — the dendra block. Attached to a response whenever a miner actually served the job (non-stream: at the root; streaming: in the last SSE chunk, since the job settles after generation). No served job means no block, so branch on its presence rather than assuming it.

• stateaudit_state is always "pending" at response time — the VRF-sampled audit lands after settlement. The verified state is read later on The Proof (recent_audits[].state) or via verify.query, straight from the chain.
• verifyTwo independent paths. proof_endpoint is a read-only feed (no secrets), served publicly at https://proof.dendranetwork.com/proof; the gateway may return it as a relative path, so resolve it against your base_url rather than passing it straight to an HTTP client. query is the dendrad command to re-check the job directly on-chain — no need to trust the gateway.
• costReal numbers. cost_udndr and usage are the actual settled cost and token counts, client-verifiable.

3 · Verify a response by script — the oracle pattern. The audit is asynchronous: re-read The Proof later, find your job_id in recent_audits, and branch.

4 · Endpoint reference. Every row was called against the live network; the code shown is the one it returns.

Paths above are relative to https://api.dendranetwork.com unless a host is written out.

The same chain is also reachable on its native ports, which is what a joining node uses:

How a request flows

Any OpenAI-compatible client points at the Dendra gateway (/v1/chat/completions) and uses the network without changing anything. The chain never sees your content — only a hash and metadata.

Verification — optimistic, LLM-as-judge

LLM output is non-deterministic, so byte-equality verification fails. Dendra uses an optimistic model (ADR-025/026/028): pay fast, then re-check a random sample with a fresh committee and an LLM-as-judge.

• k=1Paid optimistically. A single stake-weighted primary miner answers and is paid provisionally on auditable jobs. Cost falls from ~3× to ~1×; latency is one inference, which unblocks streaming and larger models.
• VRFSampled audit. The seed is posted after the commit via H(seed ‖ jobId) mod 10000 < audit_sample_bps — the miner can't know in advance whether it will be checked. The rate is an on-chain governable parameter, set high (50%) on the current testnet to gather evidence fast.
• judgeFresh committee + LLM-as-judge. On an audited job, the primary reveals to a fresh committee (excluding itself); each member runs an LLM-as-judge and commits a binary verdict. Operators run heterogeneous judge models because a shared model correlates judge errors — but that is an off-chain convention, not a rule of the network: no consensus path counts judge models or refuses a vote over one. A hard slash needs two independent locks: "invalid" from at least two-thirds of the anchored committee seats and a strict majority of the voting stake — jurors are drawn on-chain and anchored before they can vote. Both locks bind the vote; neither binds entry into the pool the jury is drawn from, which is the gap ADR-037 closes and which is still open (see the Security model below).
• slashHard slash and clawback. Proven divergence → the provisional payment is clawed back and the stake slashed (slash_leak_bps = 8000, i.e. 80%). A miner that stays silent is slashed too (no evasion), with a dedicated penalty on top (silence_slash_bps = 2000). No slash below a verdict quorum (anti false-positive). The late-reveal appeal window is implemented but dormant: appeal_window reads 0 on the chain, so an honest miner that was merely offline recovers through governance, not automatically. Do not count on it as an active protection.

Confidentiality — stated honestly

Tokenomics — $DNDR

A fixed-supply utility token: the medium for paying for inference and rewarding miners. No mint, ever — rewards are released from a pre-allocated Reserve.

Custom modules hold no mint permission, and the standard mint module is removed from the chain binary entirely — fixed supply holds by construction, verified at boot (exactly 10,000,000 DNDR, single denom). The cap does not rest on a simulation: x/mint is absent from the genesis app_state and from the binary, so no code path can create a coin, and emission only moves what the Reserve already holds. The chain's own test suite locks it — app/fixed_supply_test.go fails if a minting module reappears, if any module account gains the minter permission, or if a committed genesis posts anything other than 10,000,000 DNDR. The demand counter that gates the work subsidy is a settlement-volume proxy, not a measure of external traction.

Get testnet DNDR — the faucet

A new address holds nothing, and a miner needs a bond before it can serve. Testnet $DNDR comes from a public faucet: http://api.dendranetwork.com:4500, 10 DNDR per address, once every 24 h, with per-IP and global daily caps.

The faucet is proof-of-work gated so that each new address costs CPU (anti-Sybil). Ask it for the current difficulty, mine the nonce, then post your address:

• httpPlain HTTP, deliberately unauthenticated. Nothing secret travels there — a public address and a nonce — but the faucet's reply is not proof of anything. Confirm the credit against the chain: the wallet reads your balance from api.dendranetwork.com/rpc.
• 429Rate limited is the normal answer. One drip per address per 24 h, a per-IP daily quota, and a global daily cap — reached, they fail closed rather than draining the faucet account.

Four roles — pick yours before anything else

They are not variations of one another. They run different software, need different hardware, and carry different risk. Confusing them is the most common way to waste an afternoon here.

Run a miner

Mode A targets consumer hardware — an RTX-class GPU running a local ~8B LLM through Ollama. You are paid from real job fees; honest work is paid, lazy or wrong work is slashed. A one-command launcher brings up a testnet miner.

Read the script before running it, on its own line. A pager is interactive: anything pasted after it is swallowed as keystrokes instead of being executed, so a single copy of both lines starts nothing. Quit with q, then launch.

• GPUConsumer NVIDIA GPU (e.g. RTX-class). To mine, enough VRAM to hold an ~8B model through Ollama; larger VRAM lets you serve larger models, and so accept jobs that a smaller node cannot. To judge the bar is higher and separate: a juror must run a model validated for that role, which means ≥ 10 824 MB of VRAM, or ≥ 26 000 MB of system RAM to run the MoE judge on CPU while the GPU keeps mining. Those numbers are not round because they are not chosen: the probe names the tier-3 budget once (_JUDGE_MIN_BUDGET_MB = 9 200 MB) and derives from it the smallest VRAM that still clears it after the 15% headroom it keeps for the context window (_JUDGE_MIN_VRAM_MB); the CPU path carries its own un-lowerable floor (MOE_CPU_MIN_RAM_MB). A retyped “12 GB” turns eligible 11 GB cards away, which is why this page derives instead of copying. An under-powered judge votes against answers that are correct but differently worded, and an unfair verdict costs an honest miner its stake — which is why the gate is on the model, not on goodwill. Run bash deploy/hw_probe.sh; it answers for your machine and it is the same code the node uses. No amount, rate or return is implied — what a miner is paid comes from the fees of the jobs it actually serves, and on this chain that share is retained at settlement rather than paid out (see pay, below).
• bondBonded stake. A miner posts real $DNDR as a bond. Correct work is paid; a wrong or silent answer drawn at audit is slashed — so the bond is your skin in the game.
• payThe protocol pays from block 1 — and the payment is retained. A settled job credits the client's fee less burn and protocol cut, but hold_bps reads 10000 on this chain, so the whole of the miner's net share goes into retention at settlement and resolves at the audit checkpoint. The seed check runs before the per-job lottery: on a block whose anchored VRF contributors stay below the floor of two, no job reaches the draw at all — a floor that is met on every block since the voting power was redistributed so that the second validator actually signs. Above it the lottery runs, and the two outcomes differ — a job it does not select finalises and releases, a job it does select opens an audit and stays retained until a committee returns a verdict. On this chain none ever has: that takes audit_min_quorum = 4 jurors voting, and the jury excludes the miner under audit. vrf.contributors, vrf.min and audits_opened on the proof feed tell you where the chain stands right now. Retained is neither cancelled nor expired — the amounts are dated and queryable with dendrad query jobs held-summary. No rate, yield or amount is offered or implied, and testnet tokens have no monetary value.
• noneContribution is recorded, and nothing is promised. Every job, settlement, verdict and slash is written into its block, and snapshots are published at named heights so the record survives a reset. If a mainnet is launched the project intends that record to count among the inputs to an allocation — but no mainnet, distribution, amount, rate, date or eligibility is promised, and arriving early carries no advantage. There is no enrolment and nothing to claim.
• netOpen to join, and short of independent miners. Anyone can join permissionlessly. On the chain relaunched on 2026-08-22 there are two validators, both the project's, and no registered miner — which is precisely why nothing is verified and why the chat returns nothing. The beacon's two-contributor floor IS met — two contributors today, so audit draws are no longer deferred for want of a seed; none has ever concluded, because a verdict needs audit_min_quorum jurors voting and the jury excludes the miner under audit — so the floor is five registered miners, not four. Outside miners running the judge role are the only thing that changes that. You would be joining a network to build, not one already running.

Security model — what secures the network

Status & roadmap

Built and covered by the test suite: the full inference round trip end to end, the on-chain economy in real coins (emission, bonds, slashing, burn, pools), E2E encryption, replay-safe settlement, an RFC-9381 ECVRF beacon aggregated through vote-extensions, on-chain miner-key anchoring, and secure-by-default settings. That is what the software does — not a report on this deployment.

What this public endpoint carries — read it, do not take it from this page. Counts change without this page changing, so it hands you the query rather than the number. curl -s https://proof.dendranetwork.com/proof answers with the height it was read at, plus jobs.total, jobs.settled, jobs.audited, slashes.events, and vrf.contributors against vrf.min. Quote it with its height and anyone can re-check you.

What holds whatever those counts say, because it follows from the protocol and not from the day: on a block below the VRF contributor floor every audit draw is deferred; above it a draw runs, and a job it selects still ends settled but not verified with its share held on-chain: the jury is every registered miner except the one under audit, an empty registry leaves it empty, and concluding takes audit_min_quorum = 4 jurors voting — five registered miners in all. A validator count is not a decentralisation either: two validators are bonded, both the project's, and neither reaches two thirds — so the anti-grinding seed is armed and the draw reads live VRF contributions. Stopping either validator stops block production for everyone: fault tolerance is zero, for the opposite reason to before. It resumes when the missing node returns, and the target is a third validator. The explorer prints that share next to the count, both read from the chain rather than from here. All of it clears as operators arrive — none of it needs a code or genesis change. The network is an endpoint to read, join and break; calling it distributed or decentralized today would be false, and the word "decentralized" is used on this site only for the VRF seed mechanism.

• nowPublic testnet, open to join. A published and verifiable genesis, a deployment kit a third party can run, a read-only on-chain proof feed, an OpenAI-compatible chat, and a regex prefilter at the gateway — a floor with known false negatives, not a guarantee that unlawful content is blocked.
• nextIndependent miners — five in total. That is what lets an audit conclude and releases the retained payments: audit_min_quorum is 4, the jury excludes the miner being judged, so four jurors must vote and a fifth is the one under audit. The seed floor above them is already met, in windows, by a second project validator. Then one-click miners and throughput measured across independent operators.
• laterBusiness & mainnet. A hardware-isolated privacy tier; image generation stays gated behind a verification design. Mainnet ships when it's right — no date promised.

Reference