XavaInferencesign indocs
whitepaper · working draft

Xava Inference

Hold $XINF, earn AI credits (and tokenized NVIDIA). Spend them, or discounted inference, on any model with one key, with the accounting published.

version
0.12 (working draft)
date
25 September 2026
sections
15

Abstract

Xava Inference is built on two pillars. The first is for holders: hold $XINF and earn. $XINF is a reward coin paired with tokenized NVIDIA stock (NVDA), so its 3% transfer tax is paid to holders in tokenized NVDA automatically. A third of the supply sits in a protocol lock that is never sold; what the lock earns is swapped to USDC and becomes AI credits for $XINF holders, shared by time-weighted balance and claimed weekly.

The second pillar is the product those credits are spent on: prepaid AI inference through one API key for text, image, video, audio and embedding models, priced below what each maker charges direct. Every account decides whether its discount lowers its price or buys back a Solana token of its choice. Weekly promotions add extra discounts on some models for $XAVA stakers, paid out of our margin.

Credits are a non-transferable token, 1 credit = $1, minted only against USDC in a public reserve that always covers the supply. Usage is settled in hourly burns. When credits burn, their USDC pays the inference cost and the user's buyback split, and the margin is split 50% to $XINF buybacks into the lock and 50% to $XAVA stakers in USDC, weighted by a loyalty multiplier that grows each stake tranche from 1x to 3x over 180 days. There is no team share. Holder credits not claimed within 60 days are burned through the same split.

The usage log is hash-chained and checkpointed on-chain, every burn batch and reward list is published with a fingerprint anyone can recompute, and the lock and credits programs are open source and independently audited before mainnet. This paper describes the mechanism as designed; open items are in section 13. Nothing here is an offer of securities or a promise of returns.

1How you earn, in plain words

This section is for anyone, with no background in crypto or AI. The technical sections that follow say exactly how each step works and how to check it.

  1. You hold $XINF. $XINF is a token on Solana. You buy it and keep it in your wallet. There is nothing to stake and nothing to lock up. To earn AI credits, hold at least 1,337 $XINF on average over each hour.
  2. The 3% tax pays you NVIDIA, automatically. Every time anyone transfers $XINF, 3% is collected by the launchpad and paid out to holders in tokenized NVIDIA stock (NVDA), in proportion to what they hold. It arrives in your wallet every few minutes on its own.
  3. The lock's earnings become AI credits you claim weekly. A third of all $XINF was bought at launch into a permanent lock that can never sell, and our buybacks keep adding to it. The lock earns the same NVIDIA payouts as any holder. We swap what it earns into USDC, put that USDC in a public reserve, and turn it into AI credits for $XINF holders, shared by how much you held and for how long. Once a week you claim them with one click.
  4. Spend them on any model with one key. One credit is one dollar of AI usage. Credits work with every text, image, video and audio model in the catalog through one API key. They cannot be sold or cashed out; they are for using models.

1.1A worked example (illustrative)

The numbers below are made up to show the arithmetic. They are not a forecast: real amounts depend on trading volume, prices and how many people hold.

stepillustrative amount
you hold $XINF worth$1,000
the week's tax paid to you directly, in tokenized NVIDIA$2
the lock's earnings that week, turned into AI credits for all holders$10,000
your share of holders' time-weighted balance0.1%
AI credits you claim that week$10
what $10 of credits buys$10 of usage on any model, at your discounted price

If you do not claim a week's credits within 60 days, they expire and are burned. Nobody keeps them: their USDC is split between $XINF buybacks for the lock and $XAVA stakers, by the same rule as all spending (section 3).

1.2The second pillar: discounted AI

The same credits also buy discounted inference for anyone, holder or not. You top up with a card or USDC, get one key for every model, and pay less than the model maker's own price. Every dollar you spend is backed by USDC in the public reserve, and part of what we earn on it buys $XINF for the lock and pays $XAVA stakers (sections 5 to 8).

2$XINF and the protocol lock

2.1A reward coin

$XINF launches on the StonkFun launchpad (stonks.fun) as a reward coin: a Solana Token-2022 mint with a 3% transfer tax, paired with tokenized NVIDIA stock (NVDA) (the pair asset). The launchpad collects the withheld tax, sells it for tokenized NVDA, and pays holders pro rata to their balance, in tokenized NVDA, every few minutes.

  • Payouts are snapshot-based: each cycle reads balances at that moment. There is no holding-time weighting.
  • Trading pools, the bonding curve, burned supply and the launchpad's own wallets are excluded. Their share is not lost; it goes to the holders who are paid.
  • Holders do nothing: there is nothing to stake or claim to receive the holder rewards.
  • The distribution is operated by the launchpad, not by us. Its rules include a minimum payout per holder per cycle.

The tax applies to every transfer, including our own. Buybacks therefore swap directly into the lock's token account, so that each purchase pays the tax once rather than twice.

2.2The protocol lock

The protocol lock holds $XINF that is never sold:

  • 33% of supply bought at launch as the creator's first buy, announced in advance, and deposited into the lock.
  • Every buyback afterwards: the 50% $XINF half of margin released at every burn (section 8), expired holder credits (section 3.4) and the $XINF share of every account's split (section 7).

There is no separate team purchase or team allocation of $XINF: the launch buy goes entirely into the lock.

The lock earns the holder rewards, in tokenized NVDA, like any other holder. What it earns is swapped to USDC into the credit reserve and becomes AI credits for $XINF holders (2.3). The lock does not earn for us, and nothing it holds is available to the team or to operations.

The lock is a minimal on-chain program of our own:

  • No withdraw instruction. Nothing, and no one, can move locked $XINF out.
  • A permissionless sweep. Anyone can call one instruction that forwards the rewards the lock has received towards the credit reserve (swapped to USDC). It can move nothing else.
  • Open source and a verified build, so the deployed program can be checked against the published code.
  • An independent audit before mainnet, and then the upgrade authority removed, so the program can never be changed.

2.3AI credits for holders

The lock's tokenized NVDA is swapped to USDC, the USDC is deposited into the credit reserve, and credits backed by it are shared among $XINF holders. Each hour's pool is the USDC value of the NVDA the lock received that hour. Holders do nothing to earn them; they spend them on any model in the catalog. See /earn.

  • Hourly. Credits are shared out per hour, by each wallet's time-weighted balance over that hour (its average balance across the window), so buying just before a snapshot earns almost nothing.
  • A minimum floor of 1,337 $XINF. A wallet earns only if its average balance over the hour is at least 1,337 $XINF. Eligible wallets share the hour's pool pro rata by that time-weighted balance (token count is the weight); the weight of wallets below the floor, and of excluded addresses, goes to the eligible wallets.
  • Excluded addresses. Trading pools, the protocol lock and the launchpad's wallets earn nothing; their weight is shared among eligible holders.
  • Claimed weekly, never automatic. Credits accrue to the holding Solana wallet every hour. Once a week they are put on a published claim list; the holder signs in with that wallet and claims them on /rewards with one click. Claiming mints the credits to the account, against USDC already in the reserve. Nothing is added to a balance without a claim.
  • 60-day claim window. Each week's list can be claimed for 60 days after it is published, so several lists can be open at once and one click claims them all. Credits not claimed within 60 days expire and are burned: with no inference cost behind them, their full backing USDC goes through the burn split, 50% buys $XINF for the lock and 50% goes to $XAVA stakers (section 3.4). Nothing goes back to us.
  • For using models. Holder credits are backed by USDC but are not redeemable for cash and cannot be transferred or withdrawn.

3Credits and reserves

3.1What a credit is

A credit is $1 of prepaid inference. Credits are a non-transferable Token-2022 token on Solana: they sit on an account and can be spent, but not sent, sold or cashed out. Every credit is backed one for one by USDC held in a public credit reserve, and the reserve always holds at least the credit supply.

3.2Minting: only against USDC

Credits can only be minted against USDC deposited into the reserve. The credits program enforces this; there is no other way to create them.

  • USDC top-ups: a deposit to your address mints credits once the transfer is final.
  • Card top-ups: your balance shows the credit once the payment has cleared, and the credits are minted when the matching USDC reaches the reserve.
  • Holder credits: the lock's NVDA swapped to USDC, minted when a holder claims (section 2.3).
  • Affiliate credits: minted against the USDC set aside from the margin (section 8).

3.3Burning: hourly, by a fixed split

Usage is metered live against your balance, so a request never waits for the chain. The off-chain meter is only a buffer of usage not yet settled: every hour, the settled usage is burned in one batch. Each batch commits to the head of the hash-chained usage log (section 10) and is published with its own fingerprint. When credits burn, the program releases their USDC only by a fixed split:

Where the USDC of burned credits goes
leggoes to
inference costthe operations account, which pays for the capacity used
your buyback split$XINF and/or the token you chose (section 7)
margin: 50%buys $XINF into the protocol lock (less any affiliate cut)
margin: 50%$XAVA stakers, in USDC (section 4)

There is no team share. If a batch's margin is negative, nothing is split and the next batches repay the difference first.

3.4Expired credits

Holder credits not claimed within 60 days are burned. There is no inference cost behind them, so the whole backing USDC goes through the margin split: 50% buys $XINF for the lock and 50% goes to $XAVA stakers.

3.5Proof of reserves

The reserves section of /buybacks shows the credit supply next to the reserve's USDC, and every burn batch with its hash, its usage-log segment and its split. Anyone can check that the reserve covers the supply and that each batch adds up.

4Rewards for $XAVA stakers

$XAVA is the token of Avalaunch, a launchpad on Avalanche. 50% of our margin, released in USDC every time credits burn, goes to $XAVA stakers, weighted by stake, by time and by how long each part of the stake has been held. Stakers keep staking where they already stake, and claim on Solana.

4.1Who is eligible

  • Only $XAVA staked in the Avalaunch staking contract on Avalanche C-chain counts.
  • Weight is the stake the staking contract itself credits to an address, including compounded stake, read from its own accounting.
  • Holding $XAVA without staking, $XAVA on other chains, and bridged $XAVA do not count.
  • No exclusions. Every staker in the staking contract's pool 0 counts, by the same formula, including Avalaunch's own wallets and stakers that are contracts.

4.2Time-weighting and the loyalty multiplier

Every staker's stake is kept as tranches. Each deposit, and each compound that increases the stake, starts its own tranche at age 0. A tranche's multiplier rises in a straight line from 1x at age 0 to 3x at 180 days, and stays there. A partial withdrawal removes the youngest tranches first, so older tokens keep their age and multiplier; a full withdrawal clears every tranche. A stake transfer moves the tranches with the stake, unchanged.

m(age)  = 1x + (3x − 1x) × min(age, 180 days) / 180 days
w_i     = Σ over hours h in the week of  Σ over tranches t of i  (min amount of t during h) × m(age of t at h)
share   = w_i / Σ_j w_j
claim   = share × USDC released to stakers that week (burns + expired credits)

A deposit made late in an hour starts counting from the next full hour, so staking for a moment before a list is cut earns nothing. Tranches make the multiplier hard to game: keeping a tiny amount staked for months and then depositing a large amount gives the large amount a fresh start at the lowest multiplier.

Weighting starts at a snapshot of every staker taken when the program starts; each staker's stake at the snapshot is one tranche at age 0. From then on every deposit, withdrawal, compound and stake transfer is replayed from the staking contract's public events, so the tranches can be rebuilt by anyone, and the replay is reconciled each day against a live read of the contract.

4.3Publication: daily weights, weekly lists

Every day the stake weights, including each staker's multiplier-weighted total, are published with their fingerprint. Once a week the claim list is computed and published:

  1. It reads the USDC released to stakers by that week's burn batches and each staker's tranches on Avalanche C-chain.
  2. It computes every staker's USDC amount for the week and cumulative entitlement, and builds a merkle tree over one leaf per staker address that has a linked Solana wallet.
  3. It publishes the full list, the merkle root and a fingerprint chained to the previous week's list, so anyone can recompute them from public data; the root is also posted on Solana.
  4. Funding of the distributor is delayed by several hours after publication, so an independent watcher can recompute the list and veto a wrong one before any funds move.

4.4Claiming

  1. Sign in with the Avalanche wallet you stake from (Sign-In with Ethereum). That wallet only proves the stake; it never receives funds.
  2. Link a Solana wallet. You sign one plain binding message, "this Avalanche address pays to this Solana address", with both wallets.
  3. A first link applies at once and is used by the next weekly list. A change to an existing link takes effect after 48 hours, so a stolen session cannot silently redirect rewards. Both signatures are published with the link.
  4. Claim each list's USDC on Solana, within 60 days of its publication.

4.5The 60-day claim window

Each week's list can be claimed for 60 days after it is published. USDC not claimed in that time, a list's rounding remainder and the lines of stakers with no linked Solana wallet are added to a later week's staker pool and shared by the same formula. Nothing goes back to us.

5Discounted AI inference

The second pillar is the product the credits are spent on. Inference is a large and recurring cost for anyone building with AI models, and it is fragmented: a team using a text model, an image model, a video model and a speech model typically holds four accounts, four keys and four invoices, each billed at the maker's standard price. Discounts on that price exist, from volume commitments and capacity that would otherwise go unused, but they rarely reach the developer who pays. We offer that discounted capacity openly, let the buyer decide where the discount goes, and publish the accounting.

5.1One key, every model

One API key reaches every model in the catalog: text and reasoning models, embeddings, image generation, video generation, speech, transcription and music. The API is OpenAI-compatible, so an existing SDK needs two changes: the base URL and the key. Image, video and audio models use the same key and the same balance.

Models are presented by maker and name. A request goes to the model it names. Nothing is swapped, downgraded or quietly rerouted to a cheaper model.

5.2Prices

Every model starts from its standard price: what the model maker charges when you buy direct. Your price is the standard price minus the part of the model's current discount (section 6) that you choose to take as savings (section 7). There is no markup and no platform fee on top of the standard price. When no discounted capacity is available, a model is served at its standard price: 0% off.

5.3Routing and failover

Each request is matched to a liquidity order, and the seller behind that order serves it. If a seller fails before the response starts, the request moves to the next eligible order, and then to standard-price capacity, so a caller sees a result rather than an outage. A seller that answers with a payment or rate-limit error has its orders paused until it recovers. Once a streamed response has started it is not moved, so a caller never receives the first half of one answer and the second half of another.

5.4What we store

We never store the content of requests or responses. Per request we keep billing metadata only: the model, token or unit counts, cost, timing, status and the key used. That metadata is what the public ledger in section 10 is built from, under a pseudonym.

5.5Agents

The same API is available to AI agents through plugins for common coding agents and a remote MCP server. Agents without an account can pay per call for media models with x402 (section 12).

6The liquidity book

Discounted capacity is posted as orders in a public liquidity book. At launch the only seller is the house, and its orders are set by the operator. Third-party sellers use the same order machinery later, with budgets capped by capacity they have verified.

6.1Orders

What an order carries
fieldmeaning
scopewhich models the order can serve: any mix of model makers, categories (text, image, video, audio) and individual models
order discountthe % off the standard price the order offers, written D
budgethow much capacity the order holds, measured in standard-price value served
remainingthe budget not yet consumed by settled requests
statusactive or paused; an order can also carry a schedule and a priority

6.2Fills

  1. A request arrives for a model. Every active order whose scope covers that model is eligible.
  2. Eligible orders are sorted best discount first, then oldest first.
  3. The request places a hold of its estimated standard-price value against the best order. Holds are taken in one place per book shard, so two requests cannot spend the same budget.
  4. The request is served by that order's seller. At settlement the hold is released and the order's remaining budget falls by the request's real standard-price value.

6.3The platform fee

The platform fee comes out of the order discount, never on top of the price. For every order, including the house's, the discount a user sees is:

U = max(0, D − f)
f = platform fee = 5 percentage points (the book's current setting)

So an order at 25% off appears to users as 20% off. An order whose U is 0 after the fee is served like standard-price capacity and never counts toward "credits available".

6.40% off is always unlimited

The last row of the book is always "0% off, unlimited": standard-price capacity from the house, with no budget. A model is never unavailable because discounted capacity ran out; it simply returns to its standard price until new orders are posted.

The book is public: /models shows the aggregate depth by discount tier and recent buys (a short wallet or pseudonymous id, a time and an amount, never the model or the content).

7The split

Each account allocates its discount as savings or token buybacks. The allocation is one setting per account, applied to every request on every model; it is a share of whatever discount each request receives, so it scales with the book.

The three shares (they sum to 100%)
sharesymbolwhat it does
your discounts_disccomes off your price
$XINF buybacks_xinfbuys $XINF into the protocol lock (section 2)
custom token buybacks_custombuys a Solana token you choose, routed through Jupiter

New accounts start with the whole discount as savings. Choosing a custom token moves half of the discount to it by default; every share can be changed at any time.

7.1Pricing formulas

For a request whose standard-price value is L and whose user discount is U:

P        = L × (1 − U × s_disc)      what leaves your balance
B_xinf   = L × U × s_xinf            accrues to the $XINF buyback
B_custom = L × U × s_custom          accrues to your chosen token
P − B_xinf − B_custom = L × (1 − U)  what we keep, whatever the split

The last line is why the split is margin-neutral: we receive the same amount whichever way an account allocates its discount. The split changes only who benefits from the discount, never our share.

7.2Worked example

An illustrative order at 25% off, the current platform fee of 5 points, so U = 20%. An account splits its discount 50% savings, 25% $XINF, 25% a custom token. The request's standard-price value is $1.00.

lineformulaamount
standard priceL$1.00
user discountU = 25% − 5 pts20%
you payL × (1 − U × 0.50)$0.90
$XINF buybackL × U × 0.25$0.05
custom token buybackL × U × 0.25$0.05
we keepL × (1 − U)$0.80

The figures are an example; each model's live discount is shown beside its standard price in the catalog.

7.3Buybacks accrue from settled spend only

A buyback accrues when the request that funds it has settled and been paid for. Slider positions carry no weight on their own: an account that sets a split and spends nothing contributes nothing. The community leaderboard on /buybacks ranks tokens by the dollars actually directed to them from settled spend.

Accruals are pooled per token and executed on-chain in batches through Jupiter. A custom token must pass eligibility checks before it is bought: no freeze authority, no risky token extensions, a working route and a minimum liquidity. Until it passes, its accrual waits in dollars; it is never lost.

Current batching parameters
parametervalue
batch thresholda token's pool plans a batch at $50, or at $5 on Mondays
size cap0.5% of the token's liquidity, and at most 1% price impact per batch
slippageat most 1%; the minimum received must be at least 97.5% of the dollars in
in flightone batch per token at a time; the remainder carries to the next day

Custom tokens bought this way are held in a public vault address controlled by the treasury multisig. They are not distributed to users.

7.4x402 callers

Callers that pay per request with x402 have no account setting, so they pass a split with the call: a header X-Split: xinf=<bps>,custom=<bps>,discount=<bps> and, for a custom token, X-Split-Token: <mint>. When no split is sent, the whole discount is taken as savings and the caller pays the discounted price.

8Margin and the burn split

8.1Where margin comes from

We source inference capacity below standard price. Our cost discount c is what we pay below the standard price for a given maker. For each fill against an order with discount D and platform fee f:

margin per fill = L × (c − D + f)

Margin is released only when credits are burned for settled usage (section 3.3), never at top-up: unspent credit is still owed to its holder.

8.2The split

At every burn, the margin is split by the credits program: 50% buys $XINF into the protocol lock and 50% goes to $XAVA stakers in USDC. There is no team share. If the account that generated the margin was referred by an affiliate, the affiliate's cut comes out of the $XINF half: never out of users' discounts or the stakers' half.

Share of the margin released at a burn
case$XAVA stakers (USDC)affiliate$XINF buyback into the lock
no affiliate50%0%50%
affiliate paid in USDC50%10% in USDC40%
affiliate paid in credits50%20% as credits, minted against that USDC30%

An affiliate choosing credits receives twice the cash rate, and the buyback is reduced accordingly. Their credits are minted against the USDC set aside, like any other credit.

8.3Worked example

An illustrative set of burns releasing $1,000 of margin:

case$XAVA stakersaffiliatebuyback into the lock
no affiliate$500$0$500
affiliate paid in USDC$500$100 USDC$400
affiliate paid in credits$500$200 credits$300

The figures are an example of the shares, not a forecast of margin.

8.4The operations account

The inference-cost leg of every burn goes to an operations account, which pays for the capacity used. Refunds and chargebacks burn the affected credits and release their USDC back to operations to fund the refund.

9Weekly promotions

Each week we may announce extra discounts on specific models for $XAVA stakers, on top of the discount from the liquidity book. A promotion names its models, the extra discount, and when it starts and ends. Current promotions are marked "this week" in the catalog and on the home page.

  • For $XAVA stakers only. An account qualifies when it has a linked Avalanche staking wallet whose credited stake is above zero. The check reads the indexer's latest stake, which updates every 5 minutes and is cached for up to 5 minutes, so a new stake qualifies within about 10 to 15 minutes, and a full withdrawal stops qualifying within the same time.
  • Funded from our margin. The extra discount comes out of our side of the fill, is capped at the platform fee when it is set, and is capped again at each request's own margin, so it can never push a request below cost.
  • A plain price cut. It lowers what you pay; your split applies to the book discount as before.
  • One at a time. When several promotions cover a model, a request gets the best one it is eligible for, never the sum.

10Verifiability

Requests are metered off-chain and settled on-chain in hourly burns, so every claim has to be checkable from outside. Each claim below has a public artefact and a way to check it.

10.1The usage log

Every settled request becomes an entry in an append-only, hash-chained log. Each entry commits to the previous one, so no entry can be changed, removed or reordered without breaking every hash after it.

hash_n = sha256(0x04 ‖ "xava-usage-v1" ‖ hash_(n−1) ‖ u64le(n) ‖ canonical row_n)
account pseudonym = first 32 hex of sha256("xava-acct-v1|" + account id)

Rows carry the account pseudonym, never the account. Once a day the chain head and a merkle root over the day's allocations are posted on Solana with an SPL Memo from a dedicated attestation key:

xava-audit v1 <day> seq=<first>-<last> head=<hash> root=<root>

10.2Public exports

  • The daily audit export: the chained rows, per-pseudonym spend and accruals, per-token allocation leaves, the merkle root and the spend bound, at /api/audit.
  • Every buyback batch with its transaction, the per-token totals and the vault balances, at /buybacks. Each batch links to the audit period it was planned from.
  • The credit supply, the reserve's USDC and every hourly burn batch with its hash, usage-log segment and split, at /buybacks (section 3.5).
  • The daily stake weights (with the loyalty multiplier) and the weekly USDC claim lists with their merkle roots (section 4.3), and every wallet link with both signatures, from /rewards.
  • The weekly lists of holders' AI credits, each chained to the previous list (section 2.3).

10.3The watcher

An open-source watcher recomputes the chain, the totals, the merkle roots, the spend bound and the plan hashes from the exports, and optionally checks the memos and swaps on-chain. It exits with an error on any finding. It is meant to be run by people who are not us; going live requires that a second party runs it first.

10.4Bounds in code

  • Cumulative user buybacks can never exceed cumulative settled spend × 30%. An honest ledger cannot reach this bound; it exists to stop a corrupted one.
  • Each day's buyback plan is published as canonical text with its SHA-256. The executor refuses any job that is not a line of a plan hashing to that value.
  • Only eligible tokens are bought, with per-token caps per run.

11Security and threat model

11.1Custody

  • The treasury is a Squads v4 multisig with a time lock. Its USDC vault and its holdings vault are separate.
  • The executor's key is not a multisig member. It can only draw USDC through Squads spending limits: fixed daily caps, and a fixed destination.
  • Swap output goes directly to the holdings vault or the lock, which the executor's key cannot spend. A transaction that would route output to the executor's own account is refused.
  • A pre-approved break-glass transaction removes the spending limits if the key is ever suspected.

11.2The executor

The executor runs as a separate application in a dedicated, locked-down environment with its own keys: no shared data stores with the main application, no public routes beyond a signed health check, and outbound connections only to the main application's job feed, the chains and the swap router. It never reads our database. It re-checks every job against its own configuration: allowlisted vaults, the plan hash, per-job and per-day caps, the spend bound, price impact, slippage and minimum output.

It runs in dry-run until the owner approves going live, after at least a full day of dry runs against the real application and a watcher run by a second party. In dry-run it never reads a secret and never signs.

11.3On-chain programs

We use existing programs: SPL Token and Token-2022, SPL Memo, Squads v4, Jupiter and an existing audited merkle distributor. We write two small programs of our own: the lock (section 2.2) and the credits program (section 3), which mints credits only against USDC deposited into the reserve and releases USDC from burns only by the fixed split. Both are open source, verifiably built and independently audited in one audit before mainnet; nothing goes to mainnet without the owner's approval.

11.4Threat model

threatwhat it could dowhat limits it
executor key compromisedspend USDC from the treasuryspending limits cap it to one day's budget and a fixed destination; swap output lands in vaults the key cannot spend; break-glass removal
main application or website compromisedcorrupt balances, allocations or the reward listthe executor keeps its own allowlists and caps; the spend bound; plan hashes; the hash-chained log and daily memo; the watcher's veto window before funding
wallet or sign-in provider compromisedredirect a staker's payout walletthe binding needs signatures from both wallets; changes take 48 hours to apply
lock program flawed or upgradedmove or sell locked $XINF, or strand its rewardsthe program has no withdraw instruction, and its sweep can only forward rewards towards the credit reserve; open source, verified build, independent audit, then upgrade authority removed (section 2.2)
launchpad changes the taxraise or lower the 3% transfer tax on $XINFthe launchpad holds the fee authority and its contracts are not immutable; a change takes effect only after two Solana epochs and is public; we monitor it and ask for a written commitment. It cannot be prevented
launchpad stops paying the lockthe lock's share goes to other holders, and holder AI credits stopthe lock's inclusion is an allowlist the launchpad controls and can revoke; nothing is stuck or lost; we monitor every payout cycle (section 13)
credits program flawedmint credits without USDC behind them, or release reserve USDC outside the splitminting requires a USDC deposit into the reserve in the same instruction; burns release USDC only by the fixed split; supply and reserve are public (section 3.5); open source, verified build and an independent audit before mainnet
tokenized NVDA's issuer actsfreeze, pause, seize or burn tokens, or add a transfer hookout of our control and disclosed (section 14); the lock's sweep forwards hook accounts so a hook does not strand rewards
staking contract data wrong or changedmis-weight stakers or their loyalty tranchesstake history and tranches rebuilt from events and reconciled daily against live reads; contract upgrades and fee changes are watched and stop publication until reviewed
swap route manipulateda bad price on a buybackimpact and slippage caps, minimum output, size caps against liquidity

12Payments

  • Card, at our posted price: $100 of credit costs $105. There is no separate card fee.
  • USDC on Solana, credited one for one: $100 of USDC buys $100 of credit, so paying in USDC saves 5%. Each account gets its own deposit address; a deposit is credited once the transfer is final.
  • Either way, credits are minted only against USDC in the reserve (section 3.2).
  • Minimum top-up $5.00 of credit, by either method.
  • Credit is prepaid, is not redeemable for cash, and is spent per request at the prices shown when the request is made.

12.1x402 for media

Agents can call image, video and audio models with no account through x402: the first call returns 402 Payment Required with an exact price quoted from the request (model, and the meters that request uses), and the agent retries with a signed USDC payment on Solana. Because the price is exact, there is no overpayment to refund or hold. Text and streaming models use an API key.

13Open items

The following are to be finalised before launch. We state them because a design is only as credible as its unresolved parts are visible.

itemstatus
the lock and credits programsdesign decided: two small open-source programs of our own. The lock has no withdraw instruction and a permissionless sweep of its rewards towards the reserve; the credits program mints only against USDC in the reserve and burns only by the fixed split. Pending: one independent audit of both, the launchpad's inclusion of the lock's address in its reward distribution, and the owner's approval before mainnet.
the pair assetdecided: tokenized NVIDIA stock (NVDA). Holder rewards and the lock's rewards are paid in it; the lock's NVDA is swapped to USDC for holder credits.
the merkle distributoran existing distributor for the weekly USDC lists, after a small mainnet test; on-chain claims open at launch, and funding stays dry-run until then
reward weekdecided: weekly claim lists, each claimable for 60 days (weeks start Monday 00:00 UTC); expired holder credits are burned through the burn split
unclaimed staker USDCcurrent rule: added to a later week's staker pool; subject to owner confirmation
holder AI creditsdecided: a floor of 1,337 $XINF on the hourly average balance (section 2.3); the list of excluded addresses is published before credits start
staker exclusionsdecided: none. Every pool-0 staker counts by the same formula, including Avalaunch's own wallets and contract stakers (section 4.1).
launchpad commitmentsa commitment not to change the tax rate, and inclusion of the lock's address in distributions
card pricingdecided: the posted price is the card price ($100 of credit costs $105); USDC buys credit one for one
custom domainthe permanent public address of the site

14Risks and disclaimers

  • Utility token. $XINF is a utility token. It is not a share, a debt or a claim on Xava Inference or its revenue. Nothing in this paper is investment, legal or tax advice.
  • No guarantee of rewards. Holder rewards exist only while $XINF is transferred, and depend on a launchpad we do not control. What the lock earns, and so the AI credits for holders, may be small or zero. What $XAVA stakers receive depends on our margin, which may also be small or zero. Holder credits are for using models, not money.
  • The launchpad controls the lock's rewards. StonkFun's contracts are not immutable. The 3% tax rate, and whether the lock's address is included in holder distributions (an allowlist), are controlled by StonkFun and may change or stop at any time. Either would change or stop the lock's rewards, and so the AI credits for $XINF holders.
  • Tokenized NVDA's issuer. Holder rewards and the lock's rewards are paid in tokenized NVDA, a tracker certificate issued by Backed Assets (JE) Limited, not an NVIDIA share, with no voting rights. Its issuer can freeze any account, pause all transfers, move or burn tokens from any account, and install a transfer hook, through multisigs with no time lock. It is not offered or sold to US persons and is restricted in other jurisdictions.
  • Swaps. The lock's NVDA is swapped to USDC before it becomes credits. A swap can fill at a worse price than quoted, which lowers that hour's credits.
  • Claim within 60 days. Rewards not claimed within 60 days of their list expire. Expired holder credits are burned through the burn split; they are not paid to the holder.
  • Reserve and credits. Credits are only as good as the USDC behind them and the program that guards it. USDC itself depends on its issuer. Until the credits program is live, the reserve figures are not yet on-chain.
  • Third parties. The design relies on Solana, Avalanche, the launchpad, the issuer of tokenized NVDA, the USDC issuer, the swap router, the multisig, the distributor and the Avalaunch staking contract. Any of them can fail, change or stop.
  • Smart contracts and keys. Audited code can still have faults, and keys can be lost or stolen. The limits in section 11 reduce these risks; they do not remove them.
  • Regulation. Rewards linked to a business's revenue may be treated differently, including as regulated products, depending on jurisdiction. Participation may be restricted where you live, and the design may change to comply with law.
  • Draft. This paper describes the design as of its date. Parameters marked as current can be changed by the operator, and changes will be published.

15Glossary

standard price
what a model maker charges when you buy direct; the starting point of every price
your price
what you pay after the share of the discount you take as savings
credit
$1 of prepaid inference: a non-transferable token minted only against USDC in the reserve
credit reserve
the USDC backing every credit; always at least the credit supply, and public
burn
credits spent on settled usage, destroyed in hourly batches; their USDC is released by the fixed split
burn split
cost to operations, the user's buyback split, then the margin: 50% $XINF buyback into the lock, 50% to $XAVA stakers in USDC
order
a posted block of discounted capacity: scope, order discount D, budget
order discount (D)
the % off the standard price an order offers
platform fee (f)
the points taken from the order discount; currently 5
user discount (U)
D − f: the discount a user receives and splits
split
an account's allocation of U between savings, $XINF buybacks and a custom token
settled spend
usage that has completed and been paid for; the only source of buybacks
operations account
receives the inference-cost leg of every burn and pays for the capacity used
protocol lock
the $XINF that is never sold: 33% of supply bought at launch plus every buyback
pair asset
tokenized NVIDIA stock (NVDA), the asset $XINF is paired with; holder rewards and the lock's rewards are paid in it
holder AI credits
the lock's earnings, swapped to USDC and shared hourly among $XINF holders at or above 1,337 $XINF by time-weighted balance, claimed weekly
credited stake
the $XAVA stake the Avalaunch staking contract credits to an address, including compounding
tranche
one deposit or compound increase of a stake, aged from the moment it was added
loyalty multiplier
1x for a new tranche rising to 3x at 180 days; withdrawals remove the youngest tranches first
weekly promotion
an extra discount on some models for a week, for $XAVA stakers, paid out of our margin
reward week
Monday 00:00 UTC to the next Monday; each week's rewards are published as one claim list
claim window
the 60 days a weekly list can be claimed after it is published
merkle root
a single hash that commits to a whole list; any entry can be proven against it
watcher
independent software that recomputes everything we publish and flags any difference
executor
the isolated application that executes buybacks and publishes the reward lists
spending limit
a Squads rule letting one key draw a capped amount to a fixed destination
x402
a protocol for paying per HTTP request, here in USDC on Solana
pseudonym
a one-way hash that stands in for an account in public data
Xava
pronounced ex-AH-va

End of document. Xava Inference whitepaper, version 0.12 (working draft), 25 September 2026.