Public testnet·chain dendra·fixed supply, zero mint·reading the chain…·full state →
Drop-in OpenAI API · On-chain verifiable · Open source

AI you can verify,
not just trust.

A drop-in OpenAI API on a sovereign L1: every answer carries a proof block anchored on-chain, a sample is re-audited by an LLM-judge committee, and a cheating miner is slashed — automatically.

Open models on community GPUs, with a guarantee closed APIs cannot give you: every answer is checkable on-chain.
Where it stands today, plainly: this is a public research testnet that opened from a fresh genesis. One validator secures it — the project's own — so it is not fault-tolerant and not decentralised. The miner registry is still empty, and audit draws are paused until a second operator anchors a VRF key. The tokens have no monetary value, are never sold, and a reset erases every balance. Nothing on this page has to be taken on faith — read the live state.
0
Fixed $DNDR supply — zero mint, ever
~1s
Block time on CometBFT BFT
50%
Of jobs drawn for on-chain re-audit (audit_sample_bps, governable). The draw is paused until a second VRF contributor anchors a key
0%
Fee burn → soft, deliberate deflation
How verification works

From prompt to paid — one round trip.

Point any OpenAI-compatible client at the gateway. Every answer settles on-chain; a VRF-drawn sample is re-audited afterwards. The chain never sees your content.

A request's journey

From your question to the answer — without the chain ever seeing your content.
1 You your prompt 2 Gateway regex prefilter + escrow 3 GPU miner infers privately 4 Chain payment + proof promptencryptedproof decrypted answer, back to you Random audit VRF-sampled, re-checked
→ The gateway escrows the fee behind a regex prefilter. That prefilter is a floor, not a shield: it has strong false negatives by construction and must not be read as a guarantee that unlawful content is blocked. The prompt travels encrypted; the chain stores only hashes and metadata.
01

Encrypted request

The client encrypts the prompt to the miner's key and sends it via the OpenAI-compatible gateway. The chain sees only a fee and a job id.

02

Escrow & assignment

The fee is escrowed in a module account. An on-chain VRF beacon fixes the assignment seed, so the requester can't grind the job id to pick a complicit miner. The pool the draw reads is not yet frozen (ADR-037): registering a fresh identity after the seed is public still buys a seat.

03

Confidential inference

The assigned miner runs the model on its GPU and is paid optimistically. Plaintext exists only in RAM during compute, behind sealed-memory and egress guards.

04

Random audit & slashing

A random share of jobs is re-checked by a fresh, VRF-selected committee that judges the answer with an LLM. A wrong — or silent — miner is slashed hard.

The API

Anatomy of the dendra block.

It's the OpenAI API — change base_url and every response carries a proof block your code can act on. Settlement is on-chain for every answer; the audit lands on a VRF-drawn sample (currently 50% — a governable parameter).

Every response carries it

The proof block, field by field — as returned by the gateway.
"dendra": { "job_id": "job_…", // the on-chain anchor of this inference "miner_id": "m-…", // primary (k=1); null when a committee served "committee": ["m-…", "m-…"], // the VRF-drawn committee "beacon": "…", // anti-grinding randomness seed "audit_state": "pending", // always "pending" at response time "cost_udndr": 650, // real cost · 1 DNDR = 1,000,000 udndr "escrow_udndr": 650, "verify": { "proof_endpoint": "/proof", // read-only feed; may be relative "query": "dendrad query jobs get-job job_…" } }

Programmable trust

The oracle pattern: re-read The Proof later and decide in code.
# the audit is asynchronous — re-read The Proof, then branch audit = lookup(job_id, proof["recent_audits"]) absent → "unaudited" # not drawn by the VRF (most jobs) "clawed" → "rejected" # server was slashed — don't act on it "resolved" → "vindicated" # audited and confirmed honest otherwise → "pending" # audit in flight — re-read later
audit_state is "pending" at response time; verification lands on The Proof. Full walkthrough: API quickstart →
The Proof

Don't take it on trust. Verify.

A slash is invisible inside a normal chat — so it goes on the table instead. The explorer below reads the chain and lists audited jobs and real slashes, live. It is the one thing a closed model cannot show you.

Why cheating doesn't pay SCHEMATIC

Pay fast, verify by sampling, punish hard. Security is a calculation, not a promise.
Miner paid optimistically Random draw VRF-sampled Not drawn → final ✓ not audited, settled Committee of fresh judges LLM-as-judge: is it correct? Honest: paid ✓ vindicated Cheater stake slashed −80% Silence = admission: ignoring an audit counts as cheating.
→ Illustrative. The live feed below shows only real, on-chain events.
reading the chain…
jobs served
audited
cheaters slashed
honest vindicated
jobminerverdictstake before → afterblock
Live on-chain audit feed

Every record here is a real, replayable on-chain event, read live from the network — audited jobs and the slashes that back every answer.

Every record here is independently replayable: pull the chain, re-run the audit, get the same verdict.

Built for machines

When code acts on the answer, verify the answer.

The client isn't a person reading a chat — it's a program about to act. Dendra gives that program a proof to check before it trusts, backed by stake it can watch get slashed.

Agents that act

An agent that spends, signs, or triggers workflows shouldn't act on an answer it can't check. Read the dendra block, gate the action on the audit state, and let slashing price dishonesty out.

Oracles & AVS

Feed downstream protocols answers that settle on-chain and can be re-audited by a committee. The verdict is public and replayable — an economic backstop your feed can reference in code.

Batch pipelines

Classification, extraction, moderation at volume — spot-audited by the network itself, so output quality is enforced by economics rather than spot-checks you have to run yourself.

Sensitive workloads

Prompts are end-to-end encrypted to the serving GPU — plaintext never touches the chain, the relay, or logs. A hardware-enclave tier for regulated data is planned and does not exist: no code path implements it, and nothing on the consumer path should be read as an enclave guarantee.

Building something that needs provable AI? Get in touch.

A small group of early design partners is being onboarded while the network hardens. Enterprise SLAs and an external audit ship with the production network. What is ready today is stated plainly on this page and readable live on the explorer — nothing needs to be taken on faith.

Live demo

See it answer — then check the proof.

The chat is the network's showcase: every reply carries its verifiability panel — job id, committee, real cost, and the exact command to re-check it on-chain. Capacity varies with the network.

Confidentiality

Confidential by design.

Standard default

End-to-end encrypted client↔miner (X25519 ECDH + AES-256-GCM) — nothing in clear at the relay or on-chain. On consumer GPUs the miner decrypts in RAM to compute, guarded by sealed memory, egress and disk guards and slashing. Software attestation ships in the code but is not enforced on the public network, so it does not count as a protection in force today.

Datacenter tier planned · not available

The intended design is that on datacenter GPUs, inference would run inside a hardware secure enclave for cryptographic confidentiality, aimed at regulated workloads. It is not implemented and cannot be selected. There is no hardware root of trust anywhere in the current code, and every job on the network runs on the standard path described on the left.

The idea

A blockchain whose work is worth doing.

Proof-of-Work burns gigawatts on meaningless hashes. Dendra secures a market for what people actually want from GPUs today: AI inference — done privately, verified statistically, and paid for under an honest-stake majority.

Useful work, not waste

Miners are GPU owners running a real LLM. The work the chain rewards is verified inference for paying clients — not hashing. A consumer GPU is enough to take part.

Confidential by design

Prompts are end-to-end encrypted client↔miner (X25519 + AES-256-GCM). The relay and the chain only ever see hashes, embeddings and metadata — never your content.

Verified, not trusted

Most jobs settle instantly. A random sample is re-checked by a fresh, VRF-selected committee that judges the answer with an LLM — and a wrong answer is slashed hard. Cheating is made loss-making, not merely discouraged.

Tokenomics

A fixed-supply utility token. No mint, ever.

$DNDR is what you pay for inference and what miners earn. A hard 10M cap, with every reward released from a pre-allocated Reserve — never minted into existence.

10M
$DNDR cap
Community34% · 3,400,000
Reserve33% · 3,300,000
Validator treasury27% · 2,700,000
Team5% · 500,000
Faucet float1% · 100,000

These five balances are in the genesis file itself — download it, add them up.
The explorer reads the resulting supply back off the chain.

  • EMITDecreasing emission — each epoch releases 2 basis points of what remains in the Reserve (reserve_release_bps = 2, epochs of 86,400 blocks), and never a minted coin. That is the whole rule; no per-year figure is stated here, because an epoch's duration in wall-clock time depends on the interval between blocks, which the consensus does not fix — it is a target that follows validator configuration and can change. It is split across work (per-job, demand-gated 1.5×), availability (random slashable challenge) and security. Only the security tranche is distributed today: it goes to the fee collector, so validators and delegators receive it. The work and availability tranches accrue in the module account awaiting their own payout mechanism — a miner's income today is the client's fee, not a subsidy.
  • BURNSoft deflation — 5% of every fee is burned (fee_burn_bps = 500), so the cap only ever moves down. Deliberately not aggressive: $DNDR is a payment token, meant to stay liquid. How far it actually falls depends on real usage, so no figure is projected here.
  • FEEPay-per-token — fee = base + per-token × (in + out). The protocol takes 15% of a job; the rest pays miners. Miner rewards are funded by real, paid demand — keeping the fixed supply sound.
  • ANTIAnti-Sybil — the work subsidy is bounded by real, non-recoverable demand, so you can't pay yourself into emission. Miners post bonded stake; slashing moves real coins.

Base unit udndr · 1 DNDR = 1,000,000 udndr. The cap does not rest on a policy anyone could change: the standard mint module is absent from the chain binary, so no code path can create a coin. Check it against the running network on the explorer.

Run a node. Read the code. Break it.

Dendra is open source. Spin up a node on a consumer GPU, send a real prompt through the network, and watch it settle on-chain. Serving a job earns the client's fee minus the protocol cut — honest work is paid, lazy or wrong work is slashed. The payment is placed in escrow at settlement and released at audit finality; while the network has a single VRF contributor the audit draw is deferred, so the escrow accumulates instead of settling. Held and dated on-chain, not forfeited: it drains once a second operator anchors a VRF key.

# 1 · get the source — the first start compiles the chain binary, so you need the repo
git clone https://github.com/DendraNetwork/dendra-network.git && cd dendra-network

# 2 · point it at the network. join.sh checks the genesis SHA-256 before joining,
# so you cannot be silently pointed at a forged chain.
CONFIG_URL=http://api.dendranetwork.com:8088/network-info.txt bash deploy/join.sh

No curl … | sh: piping a URL into a shell runs whatever the server returns, unread and unverifiable. Read deploy/join.sh first — it is the same file you are about to run.

What's built

Built, running, and verifiable.

A real network with the full inference economy on-chain — every layer below is live and open source.

BUILT Working code, and where it ran

  • The full inference round trip runs end to end: encrypted prompt → gateway → escrow → VRF assignment → GPU inference → on-chain settlement. It has been exercised end to end on a development network; on the public chain it waits on a first registered miner.
  • Hard slashing executes on-chain, not on paper: a miner proven wrong loses 80% of its stake (slash_leak_bps) and a silent one takes a dedicated 20% penalty on top of the clawback (silence_slash_bps) — both governable, both readable from the live chain.
  • A real on-chain economy in real coins: Reserve emission, miner bonds & slashing, fee burn, and work / availability reward pools.
  • End-to-end encryption, a VRF beacon bound to the block hash, replay-safe settlement, least-privilege permissions — no module can mint.

Scope, and where it was measured. The slashing path above was exercised on the project's own development network: 2 validators (the larger holding ~65% of the voting power), 2 VRF contributors, and a single slash event — on a miner run deliberately to cheat, with no honest miner penalized across 43 audited jobs. That is a working mechanism on a small network, not a distributed one. The public network runs from a fresh genesis and inherits none of that history: one validator, no registered miner, and audit draws deferred until a second VRF contributor anchors a key. Read the current state from the chain, not from this page.

NEXT Shipping next

  • Freezing the draw pool (ADR-037) — open on the live chain. Registration is permissionless and the draw reads the pool at call time, so an identifier can be ground offline once the seed is public to land a seat in a committee. Until the anchor ships, treat committee membership as economically unprotected against a determined attacker.
  • Provisional payment, clawback, and permissionless appeal hardened for adversarial operators.
  • A public, multi-operator network anyone can join — today the miner registry is empty and the capacity registry declares no node. The explorer shows both counts live.
  • A datacenter hardware-isolated privacy tier for regulated workloads.
Roadmap

From a proven protocol to a network the world runs.

Build the hard part first — a chain that provably slashes cheaters. Then open it, grow the GPU community, and take verifiable AI to business. Here's the path, honestly.

Phase 0 · Protocol & security live

The hard part — built and running.

On-chain escrow, VRF assignment, optimistic verification with an LLM judge, replay-safe settlement, real-coin emission, bonds and burn — with hard slashing that has fired on-chain and no honest miner penalized so far.

Phase 1 · Public app & testnet now

Open it to the world.

A public testnet anyone can join, a live on-chain “Proof” feed, an OpenAI-compatible chat, a regex prefilter at the gateway (a floor, not a content guarantee), and monetization with buy & burn on real revenue.

Phase 2 · Community GPUs & scale next

Grow the supply.

One-click miners for community GPU owners, throughput measured across independent operators, and a broad, cross-hardware operator set.

Phase 3 · Verifiable AI for business planned

Take it to teams.

A hardware-isolated privacy tier, an external audit and SLAs, and auditable, slashable inference for companies that must prove their AI. Image generation joins here, behind the same verification bar.

Mainnet horizon

The full network.

Run by many independent operators on separate hardware, secured by everything above — shipped when it's right, not before.

FAQ

Straight answers.

Can I use my existing OpenAI client?
Yes — Dendra is a drop-in OpenAI API: point base_url at the gateway and your client works unchanged. Every response additionally carries a dendra proof block (job id, committee, real cost, verify command). audit_state is "pending" at response time; verification lands on The Proof. Capacity varies with the network. Read the quickstart →
Is there a token sale, ICO, or presale?
No. There is no sale and no fundraising. $DNDR is a utility token for paying for inference inside the protocol — it is not an investment product and nothing here is financial advice.
How do I get $DNDR to try the network?
From the testnet faucet, free: http://api.dendranetwork.com:4500 hands out 10 DNDR per address, once every 24 h. It is proof-of-work gated (anti-Sybil), so you call it from a terminal — the wallet page prints the exact command next to your address. These tokens are worth nothing. They are not sold, they buy nothing outside the protocol, and the testnet is resettable — a reset erases every balance, including yours. Create a fresh wallet for it and never reuse a recovery phrase that controls anything real.
Is the testnet rewarded?
Three answers that only hold together. The settlement path is armed, but the miner is not paid yet — a settled job splits the client's fee: validators, treasury and the dev share receive coins immediately, while the miner's entire net share is held until an audit can conclude, which cannot happen while the audit draw sits below its contributor floor. So the protocol distributes and records a debt. A proven cheat is slashed and the whistleblower recovers its bond and collects a bounty. Nothing is minted for any of it. Contribution is recorded, and nothing is promised — the record is on-chain and snapshotted, and the project intends it to count at a mainnet if one is launched, but no mainnet, distribution, amount, rate, date or eligibility is promised and being early is no advantage. And the tokens are worth nothing — they are not sold, they buy nothing outside the protocol, the chain is resettable, and a reset erases every balance including yours. No rate, yield or schedule is offered or implied.
When does a miner actually receive its payment?
At settlement the miner's net share goes into escrow rather than into its account — on the live parameters hold_bps is 10000, so the whole share is retained — and it is released at audit finality. Roughly half of all jobs (audit_sample_bps = 5000) are never drawn for audit: for those, finality is immediate and the fee is released to the miner. The rest go to a VRF-selected committee and are released once the answer is upheld. Today the draw itself is deferred: it needs a decentralized VRF seed from at least two contributors (committee_min_vrf_contributors = 2) and the network has one, so nothing releases yet. That is the protocol failing closed — a payment that cannot be verified is not released, and it is not cancelled either. The retention is held, dated and queryable (dendrad query jobs held-summary), and the backlog drains on its own once a second operator anchors a VRF key.
Is the chat free?
A subsidized free tier covers usage while the network grows, and miner rewards are funded by real, paid demand — which keeps the fixed supply sound. Open the chat →
Can I run a miner on my gaming GPU?
Yes — that's the point. Mode A targets consumer hardware (e.g. an RTX-class GPU) running a local ~8B LLM through Ollama. A one-command launcher brings up a miner.
Is my prompt actually private?
In the default mode your prompt is end-to-end encrypted between you and the miner: the relay and the chain only ever carry ciphertext, and nothing appears in clear in either. The one machine that does see it is the miner, which decrypts it in memory to run the model — there, sealed memory keeps it out of swap and core dumps, egress and disk guards stop the job from writing it out or sending it anywhere, and a miner caught misbehaving is slashed hard on-chain. The honest limit: on consumer hardware that is hardened deterrence, not a cryptographic guarantee — whoever operates the machine ultimately controls it. Software attestation is implemented but is not enforced on the public network, so please do not count it. A hardware-enclave tier for datacenter GPUs is planned and does not exist today — it is not implemented, not selectable, and must not be counted on either.
How do you know a miner's answer is correct?
Most jobs settle instantly (optimistic). A random share is then re-checked by a fresh, VRF-selected committee whose members judge the answer with an LLM — not a brittle similarity score. A wrong answer is slashed hard (−80% of stake), and a miner that simply stays silent can't escape either (anti-evasion). Cheating is engineered to be loss-making.
How is supply fixed if there are rewards?
Rewards are released from a pre-allocated Reserve (33% of genesis): each epoch of 86,400 blocks releases 2 basis points of what remains (reserve_release_bps = 2), so the release shrinks with the pool and the chain never mints new tokens. The parameter is the whole statement — no rate per year is given, because how long an epoch lasts in wall-clock time depends on the interval between blocks, which the consensus does not fix. Custom modules hold no mint permission, and the standard mint module is removed from the chain binary entirely — fixed supply holds by construction (a fresh genesis boots to exactly 10,000,000 DNDR), and app/fixed_supply_test.go fails the build if a minting module reappears or if any module account gains the minter permission. A 5% fee burn destroys part of every fee, so the supply can only move downwards.