FAQ
Is there a Sealroom token?
Yes, $SEALROOM. Its supply is fixed at 1,000,000,000, and all of it went to one public launch on equal terms, with no presale, team, investor or airdrop allocation and no vesting. The protocol's whole fee share buys $SEALROOM on the market and burns it. See Token.
Do I need $SEALROOM to use Sealroom?
No. Callers pay in USDC, operators post bonds in USDC, dispute deposits are USDC, and the protocol fee is taken in USDC before it buys $SEALROOM. Key release depends only on a node's attestation and the model's policy. You need SOL only for Solana network fees and account rent.
Which wallets can I use?
Browser wallets that support the Wallet Standard, including Phantom, Solflare and Backpack. Hardware wallets connected over USB are not offered. See Connect a wallet.
Do I need SOL to call a model?
No. The facilitator pays the network fee for every payment transaction, so a caller needs only enough USDC in its USDC account for the call. Every other action (listing a model, opening a lane, distributing, bonding, registering, disputing, claiming) is a transaction your wallet pays the fee for.
What exactly am I charged for a call?
For a fixed-price model, the amount in the node's 402 quote, which is the model's perCall price. For a metered model, the charge for the tokens actually used, ceil((input_tokens × inputPerMillionTokens + output_tokens × outputPerMillionTokens) / 1,000,000) base units, never more than the model's maxPerCall or your ceiling. The unused part of your ceiling comes back to you. The payment settles after the enclave has produced the answer, and the PAYMENT-RESPONSE header carries the Solana signature of the settlement.
Can I retry a call without paying twice?
Yes. Send the same requestId with the same body. The node returns the same quote for it, and a payment settles once.
How do I know the node is a real confidential machine?
Each node's attestation is on-chain. Three of five independent verifiers checked its Intel TDX quote against Intel collateral and its GPU evidence against NVIDIA reference measurements, confirmed the server and its GPUs are the ones the operator registered, and confirmed it runs an allowed runtime. The attestation lasts 24 hours. GET <api-url>/v1/eligibility?modelId=…&nodeId=… shows every rule for the node you are about to call, and the attestation's tlsPublicKeyHash lets your client confirm that its TLS session ends inside that enclave. See Call a model.
How are my prompt and the model's weights protected?
Your prompt travels over TLS that ends inside the attested enclave, with the TLS key bound to the node's attestation. The model's data key is wrapped to the enclave's own HPKE key, so only that enclave can unwrap it, and the weights are decrypted in the confidential VM's memory and loaded into GPU protected memory. The runtime lets the VM reach only the key brokers, the Solana RPC and the facilitator.
When does a model owner get paid?
When someone runs distribute on a lane. Anyone can, at any time the vault holds funds: the owner, the operator or anyone else, with Distribute on the model's page. One transaction pays the protocol fee (500 bps at launch), the lane's operator and every split recipient straight into their USDC accounts. See Fees and distribution.
Do I need to apply before listing a model?
No. Any wallet can list a model from Your models. The model-owner application at https://sealroom.cloud/apply?kind=model_owner is for owners who want to work with Sealroom on onboarding and buyers. Operators do apply: Sealroom vets every operator before its wallet is registered.
Can I choose which operators run my model?
Yes. A model's policy sets the runtime measurements nodes must run (up to 8), a minimum operator tier, a minimum bond and an allowlist of up to 16 operators. With an allowlist, only those operators' nodes qualify. You also decide where lanes open: a node earns from your model only through a lane on it.
How long do changes take?
| Change | Delay |
|---|---|
| A new split | 7 days after propose_split |
| A new protocol fee | 48 hours after it is proposed |
| A new runtime on the allowed list | 48 hours |
| Getting a bond back | 30 days after Request unbond (30 days) |
| A node's attestation | Renewed within every 24 hours |
| The registry after a transaction | A few seconds, as the indexer reads the chain |
Why can't an operator withdraw its bond during a dispute?
The bond is what a ruling slashes. While any dispute against the operator is open, the operator cannot request unbonding or withdraw, so the full bond stays available to the arbitration panel until it rules.
What does a "blocked" preview mean?
The API checked the chain before building your transaction and found a reason it would fail, so it built nothing and nothing reached your wallet. The status line shows the reason and its code, for example SPLIT_TIMELOCK_PENDING when a split change is not yet 7 days old. Each code and what to do about it is listed under Preview blockers.
Where does a payout go if my USDC account cannot receive it?
It is held for you in the lane as a claim while everyone else is paid. Send claim with the lane and your USDC account address to receive it. Claims belong to their recipient and do not expire. See Fees and distribution.
Can an AI agent pay for calls on its own?
Yes. Payment is per call over x402, with no account or API key: the agent reads the node's 402 quote, signs one USDC payment with its own Solana key and sends the request again with the PAYMENT-SIGNATURE header. The TypeScript client builds the payment in one call.