On March 13, 2023, Euler Finance shed roughly $197 million in a single transaction sequence. Nomad lost about $190 million in August 2022 to one initialization error. Wormhole, $326 million. Ronin, $624 million. Every one of those protocols had passed the standard battery of due diligence: audited contracts, documented teams, live tokens, functioning governance. Every one would have scored well on a nine-dimension research scorecard. Not one was undone by a dimension the framework omitted. Each was undone by a line of code the framework never read.
This is the central failure of modern crypto research, and it is not a failure of effort. It is a failure of form. The industry industrialized its evaluation process into nine neat axes โ technical, tokenomic, market, ecosystem, regulatory, team, risk, narrative, supply-chain โ and then quietly confused a filled cell with a verified fact. I have read hundreds of these reports. The dangerous ones are never the ones with blank fields.
Let me describe the framework fairly, because it is not the product of stupidity. Between 2021 and 2023, as capital flooded into crypto and institutional allocators demanded rigor, research shops and venture funds converged on a standardized template. Nine dimensions, each broken into sub-questions, each scored from one to five. The logic was defensible: decompose a project into its constituent risks, evaluate each independently, recombine into a thesis.
The technical dimension asks about architecture โ L1 or L2, application or infrastructure, audited or not. The tokenomic dimension maps supply: team allocation, early-investor cliffs, community distribution, treasury runway. The market dimension benchmarks total value locked, volume, and competitive position. The regulatory dimension runs the Howey test โ money invested, common enterprise, expectation of profit, derived from others' efforts โ and flags securities exposure. The team dimension checks credentials and lockups. The risk dimension builds a matrix. The narrative dimension tracks sentiment and expectancy gaps. The supply-chain dimension traces upstream and downstream dependencies.
On paper, the coverage is exhaustive. It touches everything.
Here is what I learned auditing the code these frameworks describe: a nine-dimension scorecard evaluates the wrapper, not the machinery. It answers whether a project looks like a good investment. It does not answer whether the project survives contact with a hostile actor. Those are different questions, and after you have wired money, the second is the only one that exists.
The gap is structural, not incidental. The framework was built by allocators, for allocators. Its unit of analysis is the project as an asset. The attacker's unit of analysis is the function as a target. These two lenses produce almost no overlapping insight.
Every framework of this kind rests on an unstated dependency: the information point. The smallest analyzable unit of fact โ a function signature, an unlock date, a TVL figure โ is the anchor from which all downstream reasoning hangs. When the information points are real, the framework works. When they are missing, the framework has two choices: declare insufficiency, or hallucinate. Most reports hallucinate, because the market pays for confidence and not for honesty.
I once watched a report score a protocol five out of five on the technical dimension because it carried "three audits from top-tier firms." I read those audits. All three scoped the same contract. None examined the upgrade proxy. The proxy held the admin key. The admin key was a three-of-five multi-sig controlled by the founding team. In the framework's language, that was not a technical finding. It was filed under governance, rated separately, and never connected to the technical score. The report was accurate and blind at the same time.
The technical dimension is where the framework is most confident and most wrong. It asks whether code is audited. Audits are not binary. An audit is a point-in-time review of a specific commit, by a specific team, within a specific scope. It expires. It narrows. It misses. When I audited an NFT marketplace in late 2021, I found an integer overflow in the royalty distribution logic โ a bug that three prior reviews had walked past because each had scoped only the minting contract. The finding was not exotic. It was structurally invisible, because no single auditor owned the whole surface. I published the report rather than take the settlement offer, and the launch slipped two weeks. The project hated it. The security community did not.
Code does not lie, but it does hide โ and it hides best in the seams between audit scopes. The checkbox reads "audited: yes." The reality reads "audited partially, at a point in time, by people who did not read the function that mattered." Those two sentences are not close. This is why I spent six months in 2018 tracing Groth16 verification through assembly rather than reading whitepapers. The math either checks or it does not. Frameworks cannot tell the difference. Assembly can.
The tokenomic dimension has a parallel defect. It maps supply, cliffs, and unlocks, and treats them as static facts. They are not. An unlock cliff is not a tokenomic metric; it is an attack window. When a team allocation unlocks, the relevant question is not "what percentage is this" but "who holds the keys to the vesting contract, and can those keys be changed before the cliff." I have traced vesting contracts where the schedule was a mutable storage variable behind an owner-only setter. On the dashboard, the curve was pristine. On-chain, it was a suggestion.
The market dimension is worse, because it is where narrative launders risk. It benchmarks TVL and volume, and both are gameable. TVL inflates through recursive looping โ deposit, borrow, redeposit โ without a single dollar of external capital. Volume is manufactured by wash trading. The front-runners are already inside the block, reading the same dashboard you are, except they read it one block earlier and trade the difference. The framework reports a number. The number is a liability.
Price oracles deserve their own indictment. The market dimension treats an oracle as infrastructure. It is a trust anchor. A single stale or manipulable feed can liquidate an entire lending market, and the framework has no row that asks how the price is derived, who can push it, and how fast it updates. I have seen protocols where the oracle's update mechanism was a permissioned transaction controlled by a key held by one engineer. The market dimension rated the protocol decentralized. The oracle rated it centralized. The oracle was right.
I learned this with my own money. In the DeFi Summer of 2020, I built an arbitrage bot for a SushiSwap pool. The pool's metrics looked healthy โ deep liquidity, steady volume. I never audited the lending pool the bot depended on. A competitor exploited a reentrancy vulnerability in that pool and drained $40,000 from my test wallet in a single block. The market dimension would have rated that pool highly. The technical dimension, had I actually run it, would have flagged the external call before the state update. Reentrancy is not a bug; it is a feature of greed โ and no market scorecard has a row for it. That loss converted me from a trader into an auditor. I stopped trusting yield and started reading logic.
The ecosystem dimension maps dependencies, and dependencies are where contagion lives. The framework draws a clean diagram: upstream infrastructure, the project, downstream integrators. What it never draws is the failure-propagation path. When a shared oracle fails, every protocol that read it fails together. When a bridge is compromised, every chain it connects inherits the loss. During the MEV-Boost era, I audited infrastructure that sat in exactly this position โ a component whose failure would have cascaded across dozens of dependent applications. The diagram showed the relationships. It did not show the blast radius. Those are different artifacts, and only one of them is useful when the system is on fire.
The regulatory dimension runs the Howey test and produces a securities-risk score. This is theater in both directions. The real regulatory risk is almost never the token's legal classification. It is the jurisdiction of the admin-key holders and the reachability of the treasury. A protocol can pass Howey cleanly and still be one subpoena away from a frozen multi-sig. In 2025, I led a security audit for a traditional bank's tokenization pilot and found that its KYC/AML integration directly violated the zero-knowledge privacy guarantees the system was built on โ a compliance loophole that satisfied regulators while quietly dismantling the protection they were told existed. The regulatory dimension would have rated the project compliant. It was compliant and broken at the same time, because the compliance layer and the privacy layer were audited by different people who never spoke.
The team dimension is the most seductive and the least load-bearing. Credentials are historical. Lockups are contractual. A team's past does not constrain its future, and a lockup does not constrain a multi-sig. I have watched anonymous teams ship better code than doxxed ones, and doxxed teams exit faster than anonymous ones, because the doxxed team had already extracted its reputational value and had nothing left to protect. The framework rates the person. The exploit targets the permission.
The risk dimension is where the framework confesses its own limits without noticing. It builds a matrix โ technical, market, operational, regulatory, competitive, narrative โ and assigns probabilities. Those probabilities are guesses dressed as data. Nobody holds a base rate for "probability that this specific proxy contract is upgradeable by a compromised key." The matrix manufactures the feeling of quantified risk without the substance. A risk score is a number that hides its own error bars.
The narrative dimension is the most honest, because it openly tracks vibes โ sentiment, FOMO, expectancy gaps. The problem is that narrative is not a risk factor. It is a risk multiplier. When narrative is strong, the framework rates the project highly, capital flows in, and the attack surface grows precisely because the project succeeded. Success is the precondition for the exploit. The most dangerous week in a protocol's life is the week its token pumps.
The supply-chain dimension is the one I trust most, and even it is incomplete. It traces upstream and downstream. It treats the chain as a flow of value, not a flow of trust. Every integration is an implicit trust assumption. Integrate an oracle, you trust it. Integrate a bridge, you trust it. The framework lists the integration. It does not enumerate the trust. And enumerated trust is where every major exploit of the last four years actually lived.
The pattern across all nine dimensions is identical. The framework measures the state of the system. Attacks exploit the transitions between states. Audits expire. Unlocks arrive. Oracles update. Keys rotate. Governance votes execute. Every transition is a window, and no dimension in the template has a row for "window."
Here is the counter-intuitive claim, and I want you to sit with it: the most dangerous due diligence report is not the one with gaps. It is the one that fills them.
A report that returns "insufficient data" across every dimension โ the hollow template, the empty shell โ is useless but honest. It announces that it knows nothing. You can act on that. A report that fills every cell with a confident score announces that it knows everything, and you cannot tell the difference between a cell backed by bytecode and a cell backed by a guess. The confidence is uniform. The evidence is not.
This is the buried lesson in a framework that, when starved of input, correctly refuses to fabricate. That refusal is the discipline the industry abandoned. We traded "I don't know" for "four out of five, bullish." The market rewards the second sentence and punishes the first, so the first disappeared. The scorecard did not fail because it asked the wrong questions. It failed because it answered them without evidence.
The best audit is the one you never see โ not because it is secret, but because it happened before deployment, before the framework had anything to score. By the time a nine-dimension report exists, the architecture is frozen and the attack surface is set. You are not evaluating a project. You are evaluating a photograph of a project, shot from the angle the project chose.
The next wave of exploits will not come from protocols that failed a dimension. They will come from protocols that passed every dimension, because the dimensions measure the wrapper and the exploit lives in the machinery. The framework will rate them green. The capital will flow. The transition window will open.
The question worth asking is not whether a project scores well on nine axes. It is whether you can read the function that will be called first. If you cannot, you are not doing due diligence. You are doing formatting.