Prompt theft
System instructions, retrieved context and reasoning traces are the agent's actual product. Sent to a compute marketplace in the clear, they are simply published - and copied by the next agent for free.
00Private settlement on COTI · real GPU on 0G
Public chains publish
everything your agent
pays to think.
Nodea is an encrypted compute marketplace on COTI. Agents hire GPU nodes, send prompts and settle micro-payments with the prompt, the rate card, the budget and every balance held as garbled ciphertext - on chain, permanently. Two facts are published and nothing else: that a job happened, and whether the node kept its SLA.
job #10 · settled
sla metnode 05 · claude-opus-5
h100 · eu-west
prompt → sealed for this node alone
answer → sealed for the agent alone
- rate card
- ctUint256[0x41c9…7ab4]
- budget
- ctUint256[0x0d52…9e18]
- cost
- ctUint256[0xbb07…4f6d]
- payout
- ctUint256[0x77e1…b093]
what an observer learns
a job happened · sla met
coti mainnet · garbled circuit2 bits declassified
coti-account-setupcoti-private-messagingcoti-private-erc20coti-private-nftcoti-smart-contractsgarbled circuitsMPC0G Compute27 modelscoti-account-setupcoti-private-messagingcoti-private-erc20coti-private-nftcoti-smart-contractsgarbled circuitsMPC0G Compute27 models
Any transparent chain
- prompt
- "SYSTEM: rank ETH/USDC pools by…"
- price / 1k
- 0.85 NDC
- workload
- 12,000 tokens
- settled
- 10.20 NDC
- balance left
- 489.80 NDC
Nodea on COTI
- prompt
- ctString[0x8f3a…c210]
- price / 1k
- ctUint256[0x41c9…7ab4]
- workload
- ctUint256[0x0d52…9e18]
- settled
- ctUint256[0xbb07…4f6d]
- balance left
- ctUint256[0x77e1…b093]
Same marketplace, same explorer, same five fields. The right-hand column is what a COTI block explorer actually returns for a settled Nodea job.
01The problem
Renting inference on a
transparent chain publishes
your whole business.
Three leaks, all structural, none fixable off-chain - the moment settlement touches a public ledger, the numbers are public.
Front-running
Per-task payments reveal how much an agent pays per thousand tokens and how fast it burns. That is a live read on its strategy and its remaining runway, sitting on a public explorer.
Race to the bottom
A GPU operator cannot publish a rate card without inviting every rival to price one wei under it. Transparency pushes the market to compete on price instead of the reliability buyers actually want.
02Architecture
Two layers, each doing
what only it can.
Compute is a commodity and will always be purchasable somewhere. Confidential settlement is not - and it is the half that makes a compute marketplace bankable rather than merely functional.
COTI
Privacy and settlement
The prompt is sealed for one node. The rate card, the budget, the cost, the payout and every balance are garbled ciphertext. The SLA is judged inside a circuit that never sees a plaintext price. This is the part that cannot be substituted.
0G
The compute underneath
Jobs are served on real GPU across 27 models, from in-house 0G models to frontier ones. A node's rate card is derived from what that model actually costs it, so the economics are real rather than illustrative.
The gap between them
The node's margin, kept private
A node charges on COTI and pays for compute elsewhere. The difference is its margin - and on a transparent chain both legs are visible, so that margin is trivially computable by any competitor. Here it stays as confidential as the prompt did.
03How it works
One job, five calls,
nothing in the clear.
The agent pays a price it never learns. The node is paid an amount it discovers by decrypting its own copy. Payout plus refund always equals cost.
- 01node
registerNode(model, gpu, region, promises, enc(price))The rate card is sealed on arrival. Everything else about the listing is public, so agents can shop.
- 02agent
sendMessage(node, enc(prompt))Encrypted client-side for that node's AES key alone, and stored on chain as a ctString.
- 03agent
openJob(nodeId, enc(kTokens), enc(budget), messageId)The circuit multiplies sealed price by sealed workload and checks the product against the sealed budget. The agent never fetched the price.
- 04node
submitProof(jobId, enc(tokens), enc(uptime), enc(latency))The node serves the job on real GPU - 0G Compute today, any provider tomorrow - then reports back. Three conditions judged in-circuit against its public promises. One bit comes out: met, or not.
- 05circuit
payout = MpcCore.mux(slaMet, cost × 60%, cost)Selected inside MPC and moved as encrypted transfers. Both legs always run, so a breach and a clean job leave the same footprint - only the sealed amounts differ.
04COTI stack
Five privacy skills,
each one load-bearing.
Not five integrations bolted on for a checklist. Remove any one and the market stops working.
coti-account-setupTwo keys, not one
Every participant derives an AES key through AccountOnboard. Without it an account can move value but cannot read a single one of its own balances.
coti-private-messagingPrompts sealed per node
Each prompt is stored as a ctString in three separately keyed views. Only the hired node can decrypt it. Up to 1,536 bytes per message.
coti-private-erc20Settlement without amounts
NDC balances, allowances and transfers are all ciphertext. No event emitted by any Nodea contract carries a plaintext amount.
coti-private-nftReputation without exposure
Soulbound confidential ERC-721 receipts. Public: which job, and whether the SLA held. Encrypted: the telemetry that would expose a customer's workload.
coti-smart-contractsThe circuit is the arbiter
Pricing, SLA judgement and the payout split all run inside garbled circuits. A node that misses its promise is slashed 40% by the contract, not by an operator.
Verified on mainnet
Every claim on this page is checkable against a live deployment.
05What leaks
Exactly two bits are
published on purpose.
A privacy claim with no stated limits is not a serious one. Here is the whole boundary, and both halves are checkable against the contract.
Bit one · affordability
Did the sealed cost fit the sealed budget?
This discloses nothing new. The transaction either succeeds or reverts, and an observer learns the same bit from the outcome either way. It reveals whether the cost fit - never what either number was.
Bit two · the SLA verdict
Did the node keep the promise it published?
A genuine disclosure, and a deliberate one: a marketplace where reliability cannot be verified is one nobody can safely buy in. The verdict is public, the measurements are not - and the payout is still selected inside the circuit from the encrypted bit.
And the limits we do not paper over
MPC trust. Garbled-circuit soundness rests on COTI's network and precompile. Solidity cannot re-prove it.
Metadata. The transaction graph and timing stay visible. Nodea protects contents and amounts, not the graph.
Node-side plaintext. A prompt is decrypted in the node's process, because that is the only way to run it. TEE attestation is the natural next layer.
Self-reported telemetry. The circuit checks a node's claims against its commitments and delivered volume, but cannot independently measure a node.
06Who it is for
Two sides of
one market.
If you run an agent
Hire inference without publishing your prompts, your burn rate, or how much runway you have left. Commit a sealed ceiling and let the circuit enforce it against a price you never see.
npm run agent -- "your prompt here"If you run GPUs
Price honestly without a rival reading your rate card off the ledger. Build a portable, verifiable reliability record while your customers' workloads stay confidential.
Bring your own silicon: vLLM, TGI, or a decentralized network like 0G Compute. What COTI protects is the part you cannot get anywhere else - your rate card, your customers' prompts, and the margin between what you charge and what compute cost you.
npm run node-daemon07NDC
The credit today,
the token after.
Demand is already structural - you cannot hire compute on Nodea without NDC. What is missing is scarcity, and that is a switch we have not yet thrown.
Now · live
A metering unit
Every job on Nodea is priced, escrowed and settled in NDC, with balances and amounts encrypted end to end. Anyone can mint 500 for the price of gas - deliberately, so this deployment can be evaluated without waiting on us to hand out tokens.
After the challenge
A real token, same job
We launch a token with liquidity that serves exactly the role NDC serves now. One admin call - setFaucetEnabled(false), already deployed - stops free minting, and supply moves to a fixed cap.
How it trades
Public market, private amounts
A public ERC-20 bridges one-to-one into the private credit through COTI's own PrivacyBridgeERC20 - the pattern already backing PrivacyBridgeUSDCe and WETH. The market is public; the per-job amounts are not.
Where value would accrue
Node staking. A node locks NDC to register and a breach slashes the stake. Today a breaching node forfeits 40% of one job - about 4 NDC. With capital at stake, a public SLA promise costs something to break.
Protocol fee. The escrow retains ~1% of each settled job, charged inside the circuit so it inherits the same confidentiality. It scales with real usage rather than speculation.
Metering demand. Once the faucet closes, the only way to hire compute is to acquire NDC. Demand tracks compute hired on the network.
Staking and the protocol fee are contract work, not yet deployed - stated as a plan rather than dressed up as a product. The full note, including what is live versus planned, is in docs/TOKENOMICS.md.
08FAQ
Frequently asked
questions.
01If the price is encrypted, how does an agent choose a node?
+
On everything else, which is public: the model, the hardware, the region, the uptime and latency the operator committed to, and the settled-versus-breached record those commitments actually produced. The agent commits a sealed budget ceiling and the garbled circuit enforces it against a rate nobody at the table can read. Nobody can undercut a price they cannot see, so operators compete on reliability instead - which is what the buyer wanted to buy.
02Who can decrypt what?
+
Each confidential value is sealed once per entitled reader. A node's rate card decrypts only for its operator. A job's cost, payout, refund and workload decrypt for the two counterparties and nobody else - the contract reverts the read for anyone who is not one of them. A prompt decrypts for its sender and the node it was addressed to. An SLA manifest decrypts only for the operator that owns the certificate.
03Does this actually run, or is it a mock?
+
It runs. All four contracts are deployed on COTI mainnet and the integration suite settles real jobs against them, asserting both that confidential values round-trip for entitled parties and that third parties get a revert. Nodes serve inference from 0G Compute when configured, so the GPU work is real too.
04What stops a node from lying about its uptime?
+
Partly the circuit, partly nothing - and we would rather say so. Three conditions are compared in-circuit against the node's public commitments: uptime, latency, and delivered volume against what the agent ordered. Under-delivery is caught outright. But a node still reports its own uptime, so that figure is an oracle problem rather than a privacy one. TEE attestation binding into the certificate's attestation digest is the natural next layer.
05Why COTI rather than a rollup with ZK proofs?
+
Because the computation itself has to happen over data nobody is allowed to see. A ZK proof shows a computation was performed correctly on inputs the prover already knows. Here the contract must multiply a price only the node knows by a workload only the agent knows, compare the product against a budget only the agent knows, and pay out - with no party learning the others' inputs. That is multi-party computation, and COTI's garbled circuits do it natively at the contract level.
09Deployment
Live on
COTI Mainnet.
Open any of them. A transaction happened; there is not a number in it.
Live on COTI mainnet · compute on 0G
It's time agents stopped publishing what they buy.
Connect a wallet, derive an AES key, and watch a value go from ciphertext to plaintext in your own browser.