HULDR — hidden receipts for AI

Protocol · Three Steps

Pay. Compute. Disappear.

Three actors. One round-trip. A receipt that survives without exposing what was asked.

01 / PAY

x402 challenge

The caller hits an inference endpoint. The provider returns HTTP 402 with a payment requirement. The caller settles via the x402 facilitator on Base, Polygon, or Solana — milliseconds, no signup.

02 / COMPUTE

Attested enclave

The model runs inside a TEE — Atoma, Marlin Oyster, or Phala dstack. The provider commits to the input, runs the inference, and binds the output to the same nonce. The enclave attestation quote is captured.

03 / DISAPPEAR

Receipt, then nothing

The caller receives the response and a HULDR receipt: input commit, output commit, payment ID, quote hash, BLS signature. Verifiable forever. The prompt and response live nowhere outside the caller's machine.

Receipt · Anatomy

A receipt is a stamp.

Mono-spaced, deterministic, portable. Verifiable offline with a single command. The aurora seal sits in the corner — the rest is fact.

HULDR · RECEIPT◇

provideratoma:meta-llama/llama-3.1-70b

paid0.00042 ETH via x402:base

ts2026-05-06T13:04:21Z

input ◇0x71a3e8c4…b8e2

output ◇0xc4d96f2a…0e17

quote ◇0xfe40b1e9…aa11 (TDX, Marlin)

sigbls12_381:0x83…2f

◆ verified offlinehuldr verify rcpt.json

Architecture

Below the aurora, a clean topology.

HULDR is a thin trust layer between caller and provider, with an optional anchor relay for compact onchain audit trails.

Built on x402 Atoma Marlin Oyster Phala dstack EIP-2537 BLS

SDK · Quickstart

Four lines on the caller. Three on the provider.

Drop-in for any TEE inference endpoint. Receipts verify offline.

// caller.ts typescript

// install: npm i @huldr/sdk
import { huldr } from "@huldr/sdk";

const client = huldr({ chain: "base" });

const { response, receipt } = await client.charge({
  provider: "atoma:meta-llama/llama-3.1-70b",
  prompt:   "redacted by design",
  maxPay:   "0.001 ETH",
});

await huldr.verify(receipt); // boolean — fully offline

// provider.ts typescript

import { huldr } from "@huldr/sdk/server";

huldr.serve({
  modelId:    "meta-llama/llama-3.1-70b",
  tee:        "marlin:tdx",
  pricePerCall: "0.00042 ETH",
}, async ({ prompt }) => runInTee(prompt));

Users · Three Personas

Who reaches for the seal.

HULDR is invisible to end users. It surfaces only at three points in any system — once per actor.

A · CALLER

The agent making the request.

Drop the SDK around any AI call. The receipt arrives stapled to the response. Store it, forget it, prove it later. No HULDR account, no signup, no extra round-trip.

↳ four lines · receipt stamped on return

// agent.tstypescript

import { huldr } from "@huldr/sdk";

const { reply, receipt } = await huldr.charge({
  url:    "https://atoma.ai/v1/chat",
  body:   { prompt },
  maxPay: "0.001 ETH",
});

// receipt.id  ◇  stamp it, ship it

B · PROVIDER

The TEE host running the model.

Bond stake once. Sign each receipt with the BLS key that lives inside the enclave — never on the host. The protocol handles x402 settlement, attestation hashing, and registry anchoring.

↳ one stake · one serve · zero leakage

// provider.tstypescript

import { huldr } from "@huldr/sdk/server";

// once per provider — bond on Base
await huldr.register({ stake: "1000 HUL" });

huldr.serve({
  modelId: "meta-llama/llama-3.1-70b",
  tee:     "marlin:tdx",
  price:   "0.00042 ETH",
}, runInEnclave);

C · VERIFIER

The auditor, the contract, the curious.

Three flavors, one proof. CLI for offline audits. Wasm for in-browser. On-chain BLS pairing when a downstream contract needs to gate on verified, paid, attested inference.

↳ offline · in-browser · on-chain (~263k gas)

$ huldr verifycli

$ huldr verify rcpt.json

  payment    x402:base    0x712a…91c
  attest     marlin:tdx   0xfe40…aa11
  pairing    bls12_381    e(-G1,σ)·e(pk,H)=1

◆ valid  ·  5.4ms  ·  offline

Discipline

What HULDR will never do.

01Read user prompts. The receipt only ever sees a commitment.
02Hold a database of caller activity. There is none.
03Take a skim. The protocol's revenue is provider stake yield, not call fees.
04Become a payment rail. We sign x402; we don't replace it.

Hidden receipts for AI inference.