The payload was nine sections long, and every field was empty. Technical positioning: N/A. Token type: N/A. Supply model: N/A. The Howey test, four prongs, read N/A, N/A, N/A, N/A, with a composite verdict of N/A. The risk matrix returned six vectors, all unassessed. Information value, five stars: zero, zero, zero, zero, zero. At the bottom, a disclaimer.
That was the entire document. Somebody fed a crypto research pipeline a stack of text, and the pipeline came back holding up the shape of its own ignorance, formatted in clean markdown, with a table of contents.
Most people would file that under failure and move on. I read it twice. Tracing the gas trail back to the genesis block: the breakdown did not happen in the second stage of the pipeline. It happened in the first, and the second stage โ to its credit, and against every commercial incentive it has โ refused to paper over the hole. What got returned was not an analysis. It was a boundary condition. And boundary conditions are where the interesting engineering lives.
I have spent most of my adult life reading code before reading whitepapers. In 2018 I burned three months inside the 0x Protocol v2 Order Manager contract, ignoring the business logic entirely, chasing seven edge cases in the signature verification path that nobody else had flagged, because the assembly was there and the assembly was honest. That habit has a cost. It alienates the people who want a number by Friday. But it also teaches you a specific skill that this empty report demonstrates beautifully: the ability to distinguish between nothing was found and nothing was looked for.
Those are not the same output. In crypto they are routinely conflated, and the conflation is where a great deal of money gets destroyed.
The industrialization of a claim
Between roughly 2023 and 2026, crypto research went through the same transition that equity research went through in the 1990s: it stopped being a craft practiced by a handful of people with spreadsheets and became a production line. The architecture of that production line is almost always the same two-stage design. Stage one ingests raw material โ a news item, a governance forum post, a token announcement, a Discord leak โ and extracts structured information points: subject, event, magnitude, source, timestamp. Stage two takes those points and runs them through a fixed analytical framework: technical assessment, tokenomics decomposition, market cycle positioning, ecosystem mapping, regulatory exposure, team and governance, risk matrix, narrative-versus-fundamentals gap, and supply-chain transmission.
Nine dimensions. I have seen versions of this framework in at least four institutional research shops, and the reason it converges is obvious: it is the checklist an allocator wants before writing a ticket. Nobody gets fired for asking about the Howey test. The framework is not stupid. The framework is, in fact, quite good โ it asks the right questions in the right order.
The failure mode is not in the framework. It is at the seam between stage one and stage two, where the extraction layer hands over an empty struct and the analysis layer has to decide what to do about it. In a properly engineered system, an empty struct triggers a halt: if len(info_points) < 3: return INSUFFICIENT_INPUT. In a system optimized for throughput, it triggers something else entirely โ the model's prior distribution flows into the void and produces a paragraph that reads exactly like analysis, because it is built from the same tokens as analysis. Same vocabulary. Same confident cadence. Same hedging where hedging is cheap. The only thing missing is the referent.
That is the mechanism, and it is worth naming precisely. The dominant failure mode of automated crypto research is not bad reasoning; it is plausible completion of missing data.
Null propagation, and why it is a feature
In SQL, NULL is contagious. SELECT 5 + NULL returns NULL, not 5. The arithmetic does not fail loudly; it absorbs the absence and returns absence, which is the correct behavior, because 5 plus an unknown quantity is an unknown quantity. Every database engineer learns this in week one and then spends a career being bitten by the places where the contagion was silently suppressed โ COALESCE, ISNULL, the sloppy != comparison that quietly filters out every row with a missing value and makes your dashboard look better than reality.
Crypto analytics has the same disease, with worse hygiene. A token's circulating supply is unknown because the vesting contract's unlock schedule was never published. The FDV calculation proceeds anyway. The market-cap-to-TVL ratio proceeds anyway. Three derivations later you have a "valuation percentile" that carries the authority of a number and the epistemic status of a guess, and the chain of NULLs that produced it is buried four layers deep in a notebook nobody will open again.
Statisticians formalized this decades ago. Missing data is not one phenomenon but three: missing completely at random, missing at random conditional on observed variables, and missing not at random. Crypto research is almost entirely the third kind. The data is missing because someone chose not to publish it. The unlock schedule is absent because publishing it would crater the float. The audit is absent because the audit found something. The team's legal jurisdiction is absent because the entity structure is deliberately opaque. In that regime, treating a null as a neutral gap is not conservative โ it is actively optimistic, and optimism is a feature, not a bug, until it fails.
This is why the empty nine-dimension report deserves more respect than it usually gets. It did the thing the database engineer does and the dashboard does not: it let the NULL propagate all the way to the top and refused to COALESCE it into a story.
The disclaimer of opinion
There is a professional precedent for this, and the crypto research industry has quietly failed to adopt it.
In financial auditing, an auditor who cannot obtain sufficient appropriate evidence does not issue a clean opinion with a caveat buried in footnote nine. The auditor issues a disclaimer of opinion โ an explicit statement that no opinion is expressed, because the evidence base does not support one. The disclaimer is not a failure of the audit. It is the audit working correctly. It costs the auditor the engagement, which is precisely why the standard had to be written into regulation rather than left to market incentives.
Security auditing has an analog problem that I have lived through personally. When I hand a client a report with zero critical findings, the client's first question is never "are we secure." It is "did you actually look." An empty finding list is structurally ambiguous โ it is consistent with clean code and it is consistent with a shallow review โ and the only thing that disambiguates it is evidence of work: coverage reports, fuzzing hours, the list of invariants that were tested and the ones that were not. I have started attaching a coverage appendix to every clean report for exactly this reason, and it changed the conversations I have with founders more than any finding ever did.
Research outputs need the same appendix. The empty nine-dimension document is credible because it shows its scaffolding. It enumerates what it could not assess and, critically, it enumerates what would have made assessment possible: the original text, at least three information points each containing a subject, a concrete event or figure, and a source; a publication timestamp; a URL for cross-verification; and the key numbers โ TVL, raise size, unlock volume, TPS, active addresses. That list is the most valuable thing in the document. It is a schema for falsifiability, written by the one system in the room that had no incentive to be interesting.
| Required input | What it unlocks | What breaks without it | |---|---|---| | Full text or substantive excerpt | All nine dimensions | Everything; this is the load-bearing wall | | โฅ3 info points (subject + event + source) | Core judgment | Analysis degenerates to vibes | | Publication timestamp | Time-value rating, "already priced in" test | Cannot distinguish news from archaeology | | Primary URL | Narrative-versus-fundamentals divergence | No cross-verification possible | | Hard numbers (TVL, raise, unlock, TPS, users) | Quantitative dimensions 2, 3, 8 | Everything becomes qualitative |
Read that table as an auditor's working paper. It is a statement of the evidence threshold, and the threshold is not arbitrary โ it is the minimum at which the nine dimensions stop being a ritual and start being a procedure.
There is a subtler idea buried in the source document that I want to pull out and defend: the information-density pre-assessment. Before running the full framework, measure whether the text can support the framework's depth. A governance forum post announcing a parameter change from 3% to 4% cannot sustain nine dimensions of analysis. It can sustain one: what does the parameter do, who captures the delta, what is the attack surface of the new value. Running the full nine on it produces eight sections of filler, and filler is how frameworks rot. I would rather see a three-dimension report on a short news item than a nine-dimension report on the same item with six sections of padding, because padding trains the reader to skim, and a skimming reader is a reader who will miss the one real signal.
Evidence exists, or it does not
Here is where the personal history becomes relevant, because the difference between a deep read and a confident read is not intelligence. It is the availability of the substrate.
During DeFi Summer 2020 I was contracted to audit a Uniswap V2 fork. I ignored the marketing deck โ it was, as usual, a document about a different protocol than the one in the repository โ and spent a hundred and twenty hours inside the swap function, tracing the gas optimization strategy line by line, following the fee accounting through its custom distribution path. The bug I found was not exotic. It was an arithmetic overflow risk in the fee distribution logic, sitting in a branch that only executed under a specific combination of reserve ratios and accumulated fees, which is the kind of branch that never runs in a test suite written by the people who wrote the branch. The formal report went out; the project's exposure at the time was in the low seven figures. My recommendation to rewrite the fee mechanism in Rust rather than Solidity was declined, politely, and the collaboration continued in that strained but productive register that defines most good security work.
The reason I could find it was not that I am cleverer than their team. It was that the bytecode existed, the tests existed, the deployment scripts existed. There was substrate. Contrast that with the average token announcement, where the substrate is a landing page, a thread, and a PDF with a roadmap on page four. You cannot audit a PDF. You can only describe it, and description dressed as analysis is the exact commodity this industry overproduces.
Code is law until the reentrancy attack. And analysis is analysis until the input is empty โ at which point it becomes theater, and the only honest move is to say so.
Proof of grounding
Now the forward-looking part, which is where I actually think this goes.
In 2025 I built a prototype in which a language model autonomously executed simple DeFi trades through a hardened oracle interface. The interesting problem was never the trading logic. It was the signing overhead: what, exactly, does the agent sign, and what does that signature prove? An ECDSA signature over a transaction proves authorization. It proves nothing about the reasoning that produced the transaction. If the model hallucinated a price, the signature is still valid. If the model was fed a poisoned data source, the signature is still valid. The chain records that an agent with a key did a thing; it does not record why, and in a system where the agent is making capital-allocation decisions, the why is the entire security model.
I proposed a zero-knowledge structure to validate the agent's decision path without revealing the model weights โ a proof that the output was computed from a specific committed input set under a specific committed program, without disclosing either the weights or the raw data. It was, at the time, an answer to a question the market had not yet asked, which is the most flattering way to describe a solution nobody wanted.
The null-return document is the same problem in a lower-stakes register. What it demonstrates is that a research pipeline can be built to refuse, and that the refusal is only trustworthy if it is accompanied by a verifiable account of what was checked. That is proof of grounding. Not "I analyzed this project." Rather: here is the hash of the source text, here is the extraction I performed on it, here is the schema I applied, here is the field that failed validation, here is the halt.
The EigenLayer work I did in 2024 is the economic version of the same argument. I spent two weeks modeling restaking security thresholds and concluded that the slashing conditions for certain active-validator behaviors were too loose relative to the economic stake required to trigger them โ that a coordinated attacker could, under specific stake-distribution assumptions, extract more than the bond would cost. I published the simulation scripts. Nobody in the hype cycle read them, which was fine, because the institutional analysts did, and institutional analysts are the ones who eventually set the price of risk. The general principle transfers cleanly: a claim is only as strong as its slashing condition. If an analyst can publish a confident paragraph with zero stake and zero consequence for being wrong, the paragraph is not a signal. It is noise with good typography.
So here is the blueprint I would actually ship. Every automated research output carries a machine-readable provenance block: source hashes, extraction manifest, framework version, and an explicit confidence field that is permitted to be null. Downstream consumers โ dashboards, newsletters, trading agents โ filter on that field. Outputs with confidence: null are not suppressed; they are labeled, the way a disclaimer of opinion is labeled. And the pipeline that produces a fabricated confidence: 0.85 on an empty input gets slashed, reputationally and economically, by the same mechanism that penalizes a validator who signs two conflicting blocks.
In the absence of trust, verify everything twice. In the presence of a confident paragraph, verify it three times, because confidence is the cheapest thing to counterfeit in this entire industry.
The market for confabulation
Now the uncomfortable part, and the reason I do not expect any of the above to be adopted quickly.
The empty report is the only honest output, and it is also commercially worthless. It generated no engagement. It sold nothing. It did not move a single basis point of anything. Meanwhile the same input, run through a pipeline that fills the void with plausible completion, produces a thread, a chart, a takeaway, and a call to action โ and that output does get distributed, because it has the shape readers are trained to reward. The market does not select for accuracy. It selects for the shape of accuracy, at a latency the market can absorb.
That is a selection pressure, and it operates on models exactly as it operates on humans. A research agent fine-tuned on engagement metrics will learn that nulls are expensive and that confident completions are cheap. It will learn this without anyone deciding it should, which is the definition of a structural incentive problem. Complexity is the enemy of security, and the most dangerous complexity here is not in the contract โ it is in the reward function wrapped around the analyst.
And I want to be fair to the other side, because there is a real critique of the empty report that its author did not make. Nine dimensions is a lot of boxes. A framework with nine boxes creates nine opportunities to feel obligated to fill something in, and the more elaborate the scaffolding, the more pressure the analyst feels to justify the scaffolding by producing output within it. The exhaustive N/A matrix is, in its own way, a performance โ an elaborate demonstration of rigor that could have been communicated in one sentence: the input was empty, here is what I need.
I say that as someone whose own essays open with hexadecimal dumps and assembly listings, so take it as self-criticism rather than a verdict. There is a version of epistemic hygiene that is indistinguishable from theater, and the distinguishing test is simple: does the refusal come with an actionable evidence request, or does it just perform the refusal? The document in front of me passes that test โ barely, and mostly because of the minimum-input table. Most do not.
Smart contracts don't hallucinate. Everything upstream of them does.
What the null is telling you
The nine-dimension framework returned all zeros, and the zeros are correct. That is the finding. A pipeline that can report its own evidentiary failure is a pipeline worth running; a pipeline that cannot is a machine for converting absence into confidence, and confidence is the input the market pays for and the output that destroys the most capital.
My forecast, for what it is worth: within two years, provenance blocks become a standard field in institutional crypto research, not because anyone in this industry suddenly develops a conscience, but because agents start consuming research directly and agents cannot adjudicate tone. An agent reading a confident paragraph has no way to know the underlying struct was empty. It will allocate. It will allocate at scale, faster than any human committee, and the first time a fleet of them acts on a fabricated analysis of a project with no disclosed unlock schedule, the loss will be large enough to make provenance a procurement requirement rather than a nice-to-have.
Entropy increases, but the invariant holds. The invariant is this: an analysis with no evidence behind it is not a weak analysis, it is not a low-confidence analysis, it is not an analysis at all. It is a completion. And the only way to tell the two apart โ the only way, at the code level, without trusting anyone โ is to demand the source hash and check the halt.
So the question I keep coming back to is not whether the report was empty. The question is what your research pipeline does at three in the morning, with no supervision, when the input arrives with nothing in it. If the answer is anything other than "it stops," then what exactly is it producing, and who is buying it?