Useful-work AI on a sovereign Cosmos L1.

Overview

Two properties make Dendra different from both proof-of-work chains and centralized AI. First, the work the network pays for is inference people actually want — not meaningless hashes. Second, that work is verifiable: a miner that returns a wrong or lazy answer is slashed on-chain, so correctness is enforced by economics rather than trust.

1 · The problem

Two trends are unserved by existing chains:

• wasteWasteful security. Proof-of-Work spends gigawatts on hashes whose only value is difficulty. The compute does nothing else.
• trustCentralized, opaque AI. Inference is concentrated in a few clouds; users must trust both the operator's honesty and its handling of their data.

Dendra addresses both: the work it pays for is inference people actually want, done privately and verifiably, on hardware people already own.

2 · Architecture

The prompt is encrypted client↔miner; the chain only ever sees a hash and metadata. After settlement, a VRF-sampled share of jobs is re-audited by a fresh committee and an LLM-as-judge.

• consensusCometBFT BFT. Blocks land about 5 s apart as measured on the live testnet — CometBFT does not fix that interval, it emerges from timeout_commit and propagation, so read it as an observation rather than a guarantee. Miners ≠ validators — owning a GPU never secures consensus.
• gatewayOpenAI-compatible endpoint (/v1/chat/completions); any existing client uses Dendra unchanged. A keyless demo tier is served under /demo/v1; the keyed /v1 answers 401 without a key, which is correct behaviour rather than an outage. Integration details are in the docs.
• on-chainThe x/jobs module: escrow, committee assignment, commit anchoring, settlement, slashing and reward pools.
• off-chainGPU miners (Ollama), an encrypted relay bus, and a Prometheus/Grafana monitoring stack.

3 · Verification — optimistic, LLM-as-judge

LLM output is non-deterministic, so byte-equality verification fails. Dendra uses an optimistic model: pay fast, then re-check a random sample with a fresh committee running an LLM-as-judge.

1. k = 1, paid fast. A single stake-weighted primary miner answers, anchors its commit, and is paid — provisionally on auditable jobs. Under the launch genesis (hold_bps at maximum) the miner's net is retained at settlement and resolved at the audit checkpoint; see 5 bis. Cost falls to ~1×, and latency is a single inference — which unblocks streaming and larger models.
2. VRF-sampled audit. After the commit, the decentralized VRF seed decides whether a job is audited — via H(seed ‖ jobId) mod 10000 < audit_sample_bps. Because the seed is posted after the commit, the miner can't know in advance if it will be checked. audit_sample_bps is governable on-chain: it reads 5000 (50%) on the current testnet, meant to fall as the network matures. That rate governs which jobs are selected; whether a selected audit opens is a separate condition, and on the current endpoint it is not met — see the Status section.
3. Fresh committee + LLM-as-judge. On an audited job, the primary reveals its answer to a fresh, stake-weighted committee (excluding itself); each member runs an LLM-as-judge and commits a binary verdict. Operators run heterogeneous judge models — a single shared model makes judge errors correlated, which is what produced false slashes under measurement — but that is an off-chain convention and not a rule of the network: no consensus path counts judge models or refuses a vote over one, so it must not be read as a protocol guarantee. A hard slash then requires two independent locks: "invalid" verdicts from at least two-thirds of the anchored committee seats, and a strict majority of the voting stake. Jurors are drawn on-chain by VRF and anchored before they can vote, so influencing a vote costs capital rather than identities. Both locks bind the vote; neither binds entry into the pool the jury is drawn from — the open gap recorded under "open" in the security model below.
4. Hard slash and clawback. Proven divergence → the provisional payment is clawed back and the stake slashed (slash_leak_bps, 80%). A miner that stays silent is clawed back and slashed too — no evasion. No slash is applied below the verdict bar, so a minority can't punish an honest miner. Honest limit: the late-reveal appeal window is implemented but dormant in the shipped genesis (appeal_window = 0) — until it is armed, an honest miner that was merely offline recovers through governance, not automatically.
5. Nash-sized. Cheating is loss-making whenever s·P > (1−s)·g (audit rate s, slash P, cheat gain g); job opening is capped so a job's fee never exceeds a safe fraction of the miner's stake.

4 · Confidentiality

• standardDefault tier. End-to-end encrypted client↔miner (X25519 ECDH + AES-256-GCM). Nothing in clear at the relay or on-chain. The miner decrypts in RAM to compute, guarded by sealed memory, egress and disk guards, and slashing. Honest limit: software attestation is implemented but off on the public network (enforcing it would pin the exact build every third-party miner must run, excluding independent operators), so it is not counted as an active protection.
• roadmapHardware-isolated tier (roadmap, opt-in). On datacenter GPUs, inference would run inside a hardware secure enclave for cryptographic confidentiality, aimed at regulated workloads. It does not exist today, and nothing in the consumer path should be read as an enclave claim.
• floorContent moderation is a regex floor with acknowledged false negatives. The protocol does not claim that illegal content is filtered out, and users are solely responsible for what they submit.

5 · Tokenomics — $DNDR

A fixed-supply utility token: the medium for paying for inference and rewarding miners. No mint, ever — rewards are released from a pre-allocated Reserve.

5 bis · Who gets paid, for what, and out of which pocket

The protocol pays for work, from block 1. Two pockets fund every flow and neither is inflation: the client fee escrowed at job opening, and the pre-allocated Reserve released in decreasing slices. There is no third pocket — x/mint is absent from the binary, so no reward path can mint.

No amount, rate or yield is stated here or anywhere else, and none can be derived. Every quantity above is a governable on-chain parameter, and what any participant receives depends on real traffic and on what remains in the Reserve. There is no reward campaign — no points, no leaderboard, no season, no airdrop; none of them is in the code.

• no mintAll rewards come from releasing the pre-allocated Reserve. Custom modules hold no mint permission, and the standard mint module is removed from the binary entirely — the protocol never mints new supply, by construction.
• anti-SybilThe work subsidy is bounded by real, non-recoverable demand, so a miner can't pay itself into emission. Bonds are real coins; slashing moves real value.
• soundThe cap is structural rather than probabilistic: x/mint is absent from the genesis app_state and from the binary, so no code path can create a coin, and emission only moves what the Reserve already holds. app/fixed_supply_test.go locks the three independent facts — no minting module wired into the application, the exact set of module-account permissions pinned (only IBC transfer holds minter, and only for foreign denominations), and every committed genesis posting exactly 10,000,000 DNDR. A fixed supply is a deliberate discipline; if long-term fees ever required it, governance could adopt a minimal, pre-disclosed tail-emission, decided then with real data.

6 · Security model

What secures the network, and why lying is expensive:

• consensusBFT ordering & finality under standard CometBFT assumptions.
• verdictThe economic verdict for correctness, up to an honest majority of the assigned committee's stake. The beacon makes assignment unpredictable; stake-weighting makes Sybil splitting pointless; real bonds make lying costly.
• randomnessAggregated randomness — per-validator VRF combined via ABCI++ vote-extensions and bound to the block hash, under strict BFT signatures. Honest state: the beacon requires a minimum of 2 contributors, and the floor is checked per block — and with one contributor today this chain meets it on none of its blocks. On a block below the floor the seed is not accepted as decentralized, and under committee_seed_source = 1 the audit draw has no fallback — it is deferred and the fee stays held. The contributor count is on-chain (committee-seed-health) and the deferred backlog is queryable (audit-deferred), so anyone can check which regime a draw ran under, or whether it ran at all.
• slashWhat slashing costs, and what has happened here. A miner proven wrong loses 80% of its stake (slash_leak_bps); a silent one takes a dedicated 20% penalty on top of the clawback (silence_slash_bps). Both are governable and readable from the chain. On this network, no slash has ever fired: the chain opened on a fresh genesis, committees are drawn on the blocks that meet the contributor floor, and not one has returned a verdict — a verdict takes audit_min_quorum jurors voting and the jury excludes the miner under audit, so a slash has had nothing to follow. jobs.audited and slashes.events on the proof feed are the figures to read, not this sentence. The slash, clawback and silence paths are covered by the chain's test suite, and the false-slash rate was measured on a single machine running every identity — a bench, not a deployment. No slash has been artifacted on a network of independent operators; producing that artifact is the next milestone, not a past result.
• no auditNot audited for production. Repeated internal review cycles, but no external security audit. The on-chain model registry can be enforced but is off on this network, so the served model is not pinned by the chain today; the audit_judge_model parameter is inert — no execution path reads it, so judge-model heterogeneity is an operator-side convention, not a protocol guarantee.
• shippedThe draw pool is frozen at the job's opening height (ADR-037). Without the anchor the draws would read the registry at call time, and an identifier could be ground offline once a seed became public to win a seat cheaply. OpenJob anchors the pool unconditionally and every draw filters on it; a missing anchor is an error, never a permissive default. Not observable from outside — no genesis field, no route — so read it in the source rather than expecting a query to confirm it.

7 · Status & roadmap

Two things are described here and they must not be read as one. What has been exercised is a project-operated bench. What is publicly reachable is a devnet endpoint, and it is a strict subset of the bench.

• benchExercised on a project bench: end-to-end real inference, the full on-chain economy in real coins (emission, bonds, slash, burn, stake-weighted committees), E2E encryption, replay-safe settlement, least-privilege permissions, a real RFC-9381 ECVRF verified on-chain, on-chain miner-key anchoring with rotation, and secure-by-default settings — all covered by the test suite. Scope: a small number of identities, most of them co-resident on one machine. That is a bench, not a deployment.
• publicPublicly reachable today: an open devnet endpoint — blocks, a queryable API, a published and verifiable genesis, and a deployment kit a third party can run. Its validator set holds two validators, both the project's, and no registered miner. Two consequences follow mechanically, and both are queryable rather than asserted: audit committees are drawn only on the blocks that meet the two-contributor VRF floor, and none of them can conclude — the jury is every registered miner but the one under audit, an empty registry leaves it empty, and a verdict needs audit_min_quorum = 4 jurors voting, so five registered miners rather than two — jobs therefore settle here while the endpoint verifies nothing and a selected job's share stays held; and because no validator reaches two thirds, the anti-grinding seed is armed and the draw reads live VRF contributions. The price is that stopping either validator stops block production for everyone: fault tolerance is still zero, for the opposite reason to before. It resumes when the missing node returns, and the target is a third validator — the explorer prints that share and the count it belongs to, with the height they were read at. It is an endpoint to read, join and break, and it is not a network of verified inference. Both conditions clear on their own as outside operators arrive; neither requires a code or genesis change.
• paidIt is not an unpaid endpoint, either. The settlement path is armed from block 1: a miner that registers and serves a job is paid by the protocol, from the client fee and the pre-allocated Reserve. What does not exist is a reward campaign — no points, no leaderboard, no season, no airdrop. Testnet $DNDR carries no monetary value, is not sold, and a reset can wipe any balance.
• wordsOn the word "decentralized". Until the behaviour above is reproduced by independent operators on separate hardware, this network is not described as distributed or decentralized. Those words are reserved for a real multi-operator deployment; on this site they qualify the VRF seed mechanism, nothing else.