Useful-work AI on a sovereign Cosmos L1.

Overview

Two properties make Dendra different from both proof-of-work chains and centralized AI. First, the work the network pays for is inference people actually want — not meaningless hashes. Second, that work is verifiable: a miner that returns a wrong or lazy answer is slashed on-chain, so correctness is enforced by economics rather than trust.

1 · The problem

Two trends are unserved by existing chains:

• wasteWasteful security. Proof-of-Work spends gigawatts on hashes whose only value is difficulty. The compute does nothing else.
• trustCentralized, opaque AI. Inference is concentrated in a few clouds; users must trust both the operator's honesty and its handling of their data.

Dendra addresses both: the work it pays for is inference people actually want, done privately and verifiably, on hardware people already own.

2 · Architecture

The prompt is encrypted client↔miner; the chain only ever sees a hash and metadata. After settlement, a VRF-sampled ~10% of jobs is re-audited by a fresh committee and an LLM-as-judge.

• consensusCometBFT BFT, ~1 s blocks. Miners ≠ validators — owning a GPU never secures consensus.
• gatewayOpenAI-compatible endpoint (/v1/chat/completions); any existing client uses Dendra unchanged.
• on-chainThe x/jobs module: escrow, committee assignment, commit anchoring, settlement, slashing and reward pools.
• off-chainGPU miners (Ollama), an encrypted relay bus, and a Prometheus/Grafana monitoring stack.

3 · Verification — optimistic, LLM-as-judge

LLM output is non-deterministic, so byte-equality verification fails. Dendra uses an optimistic model: pay fast, then re-check a random sample with a fresh committee and a pinned LLM-as-judge.

1. k = 1, paid fast. A single stake-weighted primary miner answers, anchors its commit, and is paid. Cost falls to ~1×, and latency is a single inference — which unblocks streaming and larger models.
2. VRF-sampled audit (~10%). After the commit, the decentralized VRF seed decides whether a job is audited — via H(seed ‖ jobId) mod 10000 < audit_sample_bps. Because the seed is posted after the commit, the miner can't know in advance if it will be checked.
3. Fresh committee + LLM-as-judge. On an audited job, the primary reveals its answer to a fresh, stake-weighted committee (excluding itself); each member runs a pinned LLM-as-judge and commits a binary verdict. A stake-weighted majority decides.
4. Hard slash, clawback, appeal. Proven divergence → the provisional payment is clawed back and the stake slashed (~80%). A miner that stays silent is slashed too — no evasion. An honest miner that was merely offline can reveal late within an appeal window and recover. No slash is applied below a verdict quorum, so a minority can't punish an honest miner.
5. Nash-sized. Cheating is loss-making whenever s·P > (1−s)·g (audit rate s, slash P, cheat gain g); job opening is capped so a job's fee never exceeds a safe fraction of the miner's stake.

4 · Confidentiality

• standardDefault tier. End-to-end encrypted client↔miner (X25519 ECDH + AES-256-GCM). Nothing in clear at the relay or on-chain. The miner decrypts in RAM to compute, guarded by sealed memory, egress and disk guards, attestation and slashing.
• datacenterDatacenter tier (opt-in). On datacenter GPUs (NVIDIA Hopper / Blackwell), inference can run inside a hardware secure enclave for cryptographic confidentiality — for regulated workloads.

5 · Tokenomics — $DNDR (v5)

A fixed-supply utility token: the medium for paying for inference and rewarding miners. No mint, ever — rewards are released from a pre-allocated Reserve.

• no mintAll rewards come from releasing the pre-allocated Reserve. Custom modules hold no mint permission, and the standard mint module is neutralised by zero inflation — the protocol never mints new supply.
• anti-SybilThe work subsidy is bounded by real, non-recoverable demand, so a miner can't pay itself into emission. Bonds are real coins; slashing moves real value.
• soundA 4,000-run Monte-Carlo keeps supply ≤ 10M in 100% of runs — structurally, because emission only releases the Reserve. A fixed supply is a deliberate discipline; if long-term fees ever required it, governance could adopt a minimal, pre-disclosed tail-emission, decided then with real data.

6 · Security model

What secures the network, and why lying is expensive:

• consensusBFT ordering & finality under standard CometBFT assumptions.
• verdictThe economic verdict for correctness, up to an honest majority of the assigned committee's stake. The beacon makes assignment unpredictable; stake-weighting makes Sybil splitting pointless; real bonds make lying costly.
• randomnessDecentralized randomness — per-validator VRF aggregated via ABCI++ vote-extensions, bound to the block hash, and demonstrated across two physical machines under strict BFT signatures.
• slashProven on-chain. Hard slashing is proven live: a cheating miner loses up to ~99% of its stake automatically, a silent one ~80%, with zero honest miners penalized.

7 · Roadmap