Hook
Last month a fund manager forwarded me a token due-diligence report. Thirty-four pages. Eleven charts. A nine-dimension framework โ technical, tokenomics, market, ecosystem niche, regulatory, team and governance, risk, narrative, supply-chain transmission โ each carrying its own confidence annotation. The composite score was 87 out of 100. Recommendation: accumulate.
I read it twice looking for the information-point list. Every serious research pipeline I have built or audited carries one: an enumerated array of discrete, sourced facts that the nine dimensions are supposed to consume. This report had none. Not a truncated list. Not a partially sourced one. An empty array. Every field that should have held a fact held a placeholder. The technical section read: no protocol upgrade identified. The tokenomics section read: no unlock schedule available. The regulatory section read: jurisdiction unknown.
And the document still concluded 87.
I have spent twenty-eight years reading technical claims and roughly nine of them professionally dismantling them, and I want to be precise about what disturbed me here. It was not that the analysis was wrong. It was that the analysis was shaped correctly โ the headers, the dimension partitioning, the confidence decimals โ while resting on nothing at all. The document had the topology of rigor and the substrate of a blank page. That is a new failure mode, and it deserves a name, a mechanism, and a threat model.
Context: The Framework Is Not the Failure
The nine-dimension framework is not stupid. That is the first thing to establish, because the lazy reading of this story is that frameworks are the problem. They are not. The decomposition came out of sell-side equity research and was adapted for tokens somewhere around 2019, when analysts realized that a token cannot be valued on cash flows because it usually has none, so the valuation had to be replaced by a flaw-surfacing exercise: split the asset into orthogonal axes, force an explicit judgment on each, and let any single fatal axis veto the whole.
The design logic is sound. A token can have a beautiful technical roadmap and a cliff unlock in eleven weeks. It can have immaculate governance and a single node operator behind its oracle. Orthogonal decomposition exists precisely so that one axis cannot hide behind the strength of another. When the framework is fed real inputs, it does real work.
The problem is that a framework is a consumer of facts, not a producer of them. It has no capability to generate information. Feed it nine facts and it will organize them, cross-check them, and surface contradictions you missed. Feed it zero facts and it does not output zero. It outputs structure. The headers still print. The confidence fields still populate. The composite score still computes, because 87 is an arithmetic operation on nine integers, and nine integers can be generated from nothing with perfect internal consistency.
This is why the information-point list has to be a hard precondition rather than a nice-to-have. My own rule, refined over too many audits: minimum three sourced points, ideally five to ten, each with provenance โ a contract address, a commit hash, an on-chain timestamp, a filing, a named counterparty. Three is not arbitrary. Two points define a line, and a line is a narrative; you can draw any line through any two facts. Three points define a plane, and a plane can be tested for consistency. Below three, you are not analyzing. You are illustrating.
What changed this cycle is the supply side. Research desks that once produced four reports a month now produce forty, because the drafting layer is automated and the review layer is a human skimming for tone. The nine-dimension template is the perfect substrate for this, because it is legible โ it produces documents that look like the documents a serious analyst would produce, at a fraction of the cost. And in a bull market the buyer of research is not purchasing truth. The buyer is purchasing permission to act on a decision already made. A blank report scoring 87 is more useful to that buyer than a rigorous report that says insufficient data, because one of them clears the investment committee and the other does not.
So the incentive is structural, not moral. Nobody in this chain is lying. They are all optimizing the metric they are measured on, and the metric is legibility.
Core: Tracing a Claim to Its Base Layer
The information point is the gas unit of research. Tracing the gas cost anomaly back to the EVM is the discipline I built my career on, and it generalizes further than most people expect. In 2017 I spent four consecutive nights inside the Uniswap v1 core contracts during the ICO mania, working through the library patterns wrapping the swap function. The finding was not visible at the receipt level. The receipt gives you a total gas number and nothing else. The finding only appeared when I traced downward โ through the swap entry point, through the transferFrom path, into the arithmetic that was carrying checked overflow semantics it did not need โ and reconstructed which operations were paying for safety they never used. Unchecked arithmetic in that specific path cut roughly 12 percent. The merged pull request saved the protocol something on the order of 40,000 ETH in cumulative fees over its first year.
The lesson was not about gas. The lesson was that a claim without a trace is not a finding โ it is a hypothesis wearing a finding's clothes. A gas total is a claim. An opcode trace is an information point. Once you internalize that distinction, you cannot unsee it in research documents. Every assertion in a report is either traceable to a base layer or it is decoration.
Case one: the oracle claim. A report states that oracle risk is mitigated. That sentence has no information content until it names the aggregator address. With the address you can pull latestRoundData and read the update timestamps for thirty days, which gives you the real heartbeat rather than the advertised one. With the heartbeat and the deviation threshold you can compute the actual lag: a 3,600-second heartbeat with a 0.5 percent deviation trigger on a 12-second block means the feed only refreshes after price has already moved half a percent. For a lending market running 80 percent loan-to-value, that half percent is the entire distance between an orderly liquidation and a bad-debt event. The feed is not slow in the abstract. It is slow by a number, and the number is derivable in one RPC call.
Then there is the decentralization claim itself. The number of independent node operators is a governance parameter. A governance parameter set by a foundation, revocable by a foundation, and documented in a foundation blog post is not a decentralization property โ it is a promise. I have watched this exact confusion survive four market cycles. The oracle layer remains DeFi's structural Achilles heel not because the feeds are bad, but because the evidence that the feeds are good is almost never in the report. The report says mitigated. The chain says 0.5 percent and 3,600 seconds. Only one of those is an information point.
Case two: the fraud proof claim. In 2020 I ignored the rollup narrative entirely and spent six months inside the dispute mechanics of the original Optimism testnet, writing a Python harness to submit malicious state roots and observe what the challenge game actually did under adversarial timing. The output was a twenty-page whitepaper on fraud proof vulnerabilities in naive optimistic models, and the finding that has aged best is the boring one: the seven-day challenge window is a parameter, and parameters have edge cases. Under specific reentrancy orderings the window was not insufficient because seven days is short โ it was insufficient because the bond economics made a griefing strategy marginally profitable at the boundary. Three security firms cited it. None of them cited it because the number seven is wrong. They cited it because I had traced the number to the game theory underneath it.
Which brings us to the current reporting on L2 maturity. A report will state that fraud proofs are live. The information points required to evaluate that sentence are: is the proposer set permissioned, and if so what is its cardinality; what is the bond denominated in; what is the maximum duration of the escalation game; who can pause the contract. If the whitelisted proposer set has size one, then fraud proofs are live in the same sense that a monarchy has elections. Tracing the gas cost anomaly back to the EVM, in this context, means tracing the security claim back to the permission table โ and the permission table is public, and it is in the report's source material, and the report did not open it.
I will go further, because I think it is the most under-reported structural fact in this cycle: the real difference between the major rollup stacks is not the proof system. It is who can convince more projects to deploy chains first. That is a distribution contest wearing a cryptography costume. A nine-dimension report that scores the technical axis at 92 and never examines the distribution axis is measuring the costume.
Case three: the float claim. The tokenomics dimension is where empty arrays do the most damage, because the placeholder numbers are plausible. Consider a report that states community allocation at 40 percent. Now open the schedule. One billion supply, 40 percent community โ but 25 percent of that community bucket is ecosystem incentives held by a foundation multisig with a 3-of-5 threshold, two of whose signers are foundation employees. Effective community float at token generation event: 4 percent. The report said 40. It was not lying about the schedule; it was reporting the headline rather than the recipient class.
The information points required here are a table, not a sentence: date, tranche size, recipient class, and cost basis. Cost basis is the one everybody omits, and it is the only one that determines overhang. A 12-month cliff on tokens acquired at 0.02 against a 4.00 market is not an unlock, it is a scheduled distribution of exit liquidity, and the arithmetic is trivial once you have the fourth column. Without cost basis you cannot compute overhang; you can only compute supply. Those are different questions and the framework has been quietly conflating them for years.
Case four: the audit claim. In 2021, during the NFT mania, I turned down several well-paid influencer arrangements to do a line-by-line read of the ERC-721A implementation that Azuki was preparing to ship. The finding was a subtle integer overflow in the mint path that, under high concurrency, could allow a user to mint beyond the intended cap. I reported it privately; it was patched before mainnet. I declined compensation and pushed the equivalent to a decentralized science grant, which cost me a number of relationships and bought me something more useful.
The relevant information point is not that audit happened. It is the commit hash, the scope of the audit, the date, and whether the metadata hash embedded in the deployed bytecode matches the audited build. That last check is a single eth_getCode call. It takes four seconds. Almost no research report performs it, which means almost every audit claim in circulation is a claim about a document rather than a claim about a contract.
The mechanism: why an empty array produces confident prose. This is the part that deserves a threat model, because it is new. A drafting model trained on the distribution of completed research reports has learned that dimension fields get filled. The token sequence N/A repeated nine times has near-zero entropy, and under a low-entropy context the next-token distribution drifts toward the corpus mean โ and the corpus mean is a filled report. The model is not hallucinating facts from malice. It is completing a shape. Structure is the path of least resistance, and structure is exactly what a nine-dimension framework supplies in abundance.
This is why the refusal artifact matters so much. The document I opened was not, in fact, a fabricated report. It was a pipeline that had detected an empty input, refused to proceed, printed N/A across all nine dimensions, and appended a backfill form requesting the minimum viable information set. That refusal is the single most information-dense object in the entire research stack. It is also the first thing every human in the forwarding chain deletes, because a form requesting data is not something you can send to an investment committee.
Contrarian: The Empty Report Is the Safe One
The counter-intuitive conclusion is that the all-N/A report is the least dangerous artifact in this market. It is self-announcing. A reader who sees nine N/A fields knows immediately that they hold nothing. The dangerous report is the one with three real information points and six plausible ones, because the reader cannot distinguish which three are load-bearing. Three out of nine is not a partially complete analysis. It is camouflage. The empty array fails loudly; the half-empty array fails silently, and silent failure is the only kind that gets capital allocated against it.
A second uncomfortable turn: the demand for rigor and the demand for legibility are not the same demand, and the market has clearly chosen. A research report's primary economic function is not prediction โ it is accountability transfer. It moves the burden of justification from the person who decided to the document that justified. An 87 out of 100 across nine dimensions with confidence decimals is an extremely efficient accountability-laundering device, and it is efficient precisely because it is unfalsifiable at the formatting layer. You cannot audit a document for rigor by reading its table of contents.
And a third: the framework's inheritance is the problem, not its execution. Nine orthogonal dimensions is a sell-side structure built for equities, where the underlying entity files audited financials under a common standard. Tokens have no audited financials, no common standard, and dimensions that are not actually orthogonal โ technical risk and governance risk collapse into each other the moment a multisig can pause a bridge. Applying that framework to a token is like applying GAAP to a gas meter. It produces a number. The number is not accounting.
Takeaway
The forward-looking bet is what I would call proof-carrying research: reports that ship their information-point array as a hash-committed artifact alongside the prose, so a verifier can recompute the input density in one pass and reject anything below threshold. The technology is trivial. The incentive is the hard part, and it will arrive from the buy side, not the sell side โ the first fund that publishes its refusal rate, the percentage of deals declined specifically for insufficient information points, will out-signal every competitor publishing hit rates. My expectation is a two-tier research market by 2027, priced differently, graded on inputs rather than page count.
Tracing the gas cost anomaly back to the EVM taught me that the number you are shown is never the number that matters. The question is not whether your research pipeline can produce nine dimensions. It is whether it can produce zero, and say so out loud.