The Empty Field: On the Discipline of Not Knowing in a Market That Rewards Certainty

For three weeks this spring, I watched a freshly funded protocol with a nine-figure treasury publish a governance dashboard whose most consequential column returned the same three characters — N/A — across roughly forty percent of its rows. Nobody flagged it. The community read the blanks as a clean bill of health, the way a patient reads an unremarkable scan. What they were actually looking at was an empty field dressed in the costume of evidence, and the costume was convincing enough that a thousand people nodded at it in unison.

I have spent twenty-eight years inside this industry, most of them as an auditor and a governance architect, and I have come to believe that the most dangerous number on any screen is not the one that is wrong. It is the one that is missing and quietly allowed to pass for true. A wrong number can be caught. A blank that everyone has agreed to interpret as a yes is almost impossible to catch, because catching it requires someone to stand up and say the least fashionable sentence in modern finance: we do not know.

That sentence is the beginning of this essay. It is also, I think, the unfinished business of an entire technological movement.

The blockchain industry built its reputation on the ruthless verification of state. We can prove that a balance changed, that a transaction settled, that a contract executed exactly as written. We spent a decade and billions of dollars industrializing this capacity: consensus mechanisms, zero-knowledge proofs, data availability sampling, fraud proofs. If the question is "what did the ledger do," we have answers that border on the theological in their certainty.

But the ledger has always been the easy part. The hard part — the part we have largely outsourced, ignored, or papered over — is the information layer that feeds the ledger. Where did the price come from? Who verified the collateral? What was the off-chain event that triggered the on-chain consequence? Every oracle, every bridge, every tokenized real-world asset is, at bottom, a machine for converting unverified information into verified state. And every one of them contains a blank field at its heart.

The history of this industry is, in large part, a history of that blank field being exploited. Mango Markets in 2022 was not a failure of Solidity; it was a failure of information. An attacker manipulated a thin market to move an oracle price, and the protocol faithfully, correctly, and catastrophically recorded the resulting state. The code did exactly what it was told. The information it was told was false, and there was no mechanism in the system that could distinguish a truthful price from a manufactured one, because both arrive as the same bytes.

We call this the oracle problem, and we treat it as a solved engineering challenge — a matter of enough nodes, enough sources, enough economic stake. I want to suggest, gently, that we have misdiagnosed it. The oracle problem is not fundamentally a problem of consensus. It is a problem of provenance, and provenance is a question about meaning, not arithmetic.

Let me start with a technical distinction that I think the industry has collapsed at great cost. There is a difference between verification and truth. Verification is a procedure: a deterministic function that returns true or false given an input and a proof. Truth is a property of the world. The entire genius of the blockchain is that it made verification cheap and reliable while remaining completely agnostic about truth. A signature replay attack, like the one that drained fifty thousand dollars from the Community DAO I helped design in 2020, does not break verification. Every signature in that attack was valid. Every check passed. The system verified perfectly, and it was perfectly wrong.

This is not a bug that can be patched. It is a structural feature of any system that reduces the world to bytes. And it means that the integrity of our industry depends less on the sophistication of our cryptography than on the discipline of our information practices — the unglamorous work of asking where a claim came from, who stands behind it, and what would have to be true for it to be false.

The emerging answer to this, at least at the technical layer, is attestation. Protocols like the Ethereum Attestation Service have quietly become one of the more interesting developments of the last two years, precisely because they do not pretend to solve the oracle problem. Instead, they make provenance legible. An attestation is a signed, structured claim: this address asserts that this data has this property, at this time, under this schema. It does not tell you whether the claim is true. It tells you who made it, when, and under what terms — which is often the more useful piece of information.

I want to dwell on this because I think it is the closest thing we have to an honest architecture. When I audited the EtherTrust contracts in 2017 — the two million dollars of raised capital with a reentrancy vulnerability that I refused to sign off on — the founders did not lack confidence. They lacked provenance. They could not tell me where their assumptions about user behavior had come from, and when I asked, the question was received as an insult rather than an audit finding. The vulnerability was technical, but its root cause was epistemic: nobody in the room had the standing to say "we have not verified this, and we should not pretend that we have."

Attestation systems give that standing a formal expression. A well-designed schema does not merely record that something is true; it records the boundaries of what is known. It can encode "verified by three independent sources" and it can equally encode "single-source, unverified, use with caution." The second attestation is not a failure of the system. It is the system working, because it is honest about the shape of its own ignorance.

The most important innovation in on-chain information is not the ability to prove a claim true, but the ability to prove a claim's provenance and its limits — including the limit of not knowing.

Now, the market does not reward this. Let me be concrete about why, because the incentives here are brutal and worth tracing.

Consider how a modern protocol actually assembles the information it acts on. A price feed aggregates exchange data. A bridge listens for events on a source chain. A governance dashboard ingests off-chain reports and presents them as a unified view. At every one of these junctions, there is a transformation from the messy world into structured bytes, and at every junction, the transformation is performed by software that was written by someone with an incentive. The incentive is almost never to be accurate. The incentive is to be complete, because completeness is what gets shipped.

This is where the empty field becomes dangerous. When a data pipeline encounters a gap, it has three honest options and one dishonest one. It can return an error, which breaks the downstream consumer. It can return an explicit null, which forces the consumer to handle it. It can halt, which is expensive. Or it can return a default value — zero, false, N/A, an empty string — which is cheap, keeps the pipeline flowing, and quietly converts an absence into an assertion. Guess which one wins in production.

I have seen this pattern so many times that I now treat it as a signature of systemic risk. In 2021, when I worked with indigenous Australian artists to mint a hundred NFTs and route ten percent of royalties to community trusts, the technical work was straightforward. The hard work was resisting the pressure to represent the collection's value in ways that were convenient rather than true — to let the speculative numbers stand in for the cultural ones. The market wanted a floor price. The artists wanted a story. A dashboard that showed only the floor price was not lying, exactly. It was simply returning the field that was easy to fill and leaving the important ones blank.

This is the quiet mechanism by which a market that prides itself on transparency becomes opaque. Not through concealment, but through the selective filling of fields. The visible numbers are true. The invisible ones are missing. And the aggregate impression — the thing a human being actually acts on — is a fabrication assembled from true parts.

There is a data-availability dimension to all of this that I think is underappreciated, and it connects to a prediction I have carried since the Dencun upgrade. Blob space, which currently makes the publication of large provenance datasets cheap, will saturate within two years. When it does, the cost of publishing the very attestation data we need will double, and the honest schemas — the ones that carry the most metadata — will be the first to be stripped down, because metadata is the easiest thing to cut when the fee market tightens. The industry's appetite for provenance is, in other words, about to be tested by its willingness to pay for it.

We already have a preview of how that test usually goes. Consider the parade of so-called Bitcoin Layer 2s that have raised capital over the past eighteen months. The overwhelming majority of them are Ethereum projects wearing a new provenance, borrowing the cultural weight of Bitcoin while inheriting none of its assumptions. This is not a technical failure, strictly speaking; many of them are competently engineered. It is a failure of provenance — a claim of origin that does not survive inspection, dressed in the branding of a community that never asked for it. If we cannot even keep the provenance of a project straight, what hope do we have for the provenance of the data inside it?

And even the mechanics we treat as settled market facts are, on inspection, claims. The interest rate models in Aave and Compound are routinely described as if they had discovered a price. They did not. They encoded a curve — a chosen relationship between utilization and rate — and then presented the output of that curve as though it were the market speaking. The curve is a design decision. It reflects the assumptions of its authors, not the revealed preferences of borrowers and lenders. To call it a market rate is a provenance error of the most consequential kind, because it launders a human judgment into an apparent fact, and then lends that fact the authority of mathematics.

This is where the empty field stops being a metaphor and becomes a structural condition of DeFi. Every parameter in a lending protocol is a field that someone filled with a value they chose. The field is not empty, so it does not look like a gap. But the value in it is not discovered. It is asserted, and the assertion is invisible because it arrives already formatted as a number.

I want to push this further, because I think it connects to a structural feature of the current cycle that few people are naming. We are in a bull market, and bull markets have a characteristic information pathology: they reward narrative velocity over verification. The faster a story can be told, the more capital it attracts. This is not new. But what is new is that the storytelling itself has been automated. Large language models can now generate a plausible research report, a plausible audit summary, a plausible governance analysis, in seconds and at negligible cost. And these outputs are indistinguishable, at the level of form, from the real thing.

I recently received, from a founder I respect, a "deep analysis" of a protocol's tokenomics that was beautifully structured, confidently worded, and almost entirely without information. Every field was filled. Every section had a heading. The conclusion was decisive. And when I traced its claims back to sources, I found that a substantial fraction of them originated from the same model that had written the report — a closed loop of self-reference dressed as research. The document was not wrong in the way a bad calculation is wrong. It was empty in the way the dashboard was empty: complete in form, hollow in substance.

This is the information-layer equivalent of a reentrancy attack. The system is called, it responds correctly, and the correctness of the response is precisely what allows the exploitation. A confidently formatted hallucination reenters the trust that readers extend to well-structured prose. The reader sees a heading, a bulleted list, a bolded conclusion, and extends the same credence they would to a genuinely researched document. The format is the vulnerability.

When content generation becomes free, the scarce resource stops being information and becomes provenance — and any system that prices content without pricing provenance will be flooded with confident emptiness until it collapses under the weight of its own certainty.

Let me be technical about what a real fix looks like, because I do not want to leave this at the level of complaint.

The first component is cryptographic provenance for content. The C2PA standard, which attaches signed content credentials to media, is the most mature effort here, and its logic generalizes. If a document carries a signed manifest describing its origin, its authoring tools, and its edit history, then a reader can at least verify that the document is what it claims to be and that its claims trace to identifiable sources. This does not make the content true. It makes the content attributable, which is the precondition for accountability.

The second component is on-chain attestation of the provenance chain. Attestation services can record, in a schema anyone can inspect, the sequence of claims and their sources. A research report could carry an attestation that lists its primary sources, the identities that vouch for them, and the confidence assigned to each. This is not a truth machine. It is a rumor ledger — a public record of who said what, when, and with what standing. In a market where reputation is the only real collateral, a rumor ledger is a form of collateral.

The third component, and the one I care about most, is the discipline of representing absence. A schema that cannot express "unknown" is a schema that will manufacture certainty. This sounds trivial. It is not. Designing a data model that can faithfully represent the boundaries of knowledge — that can say "this field was not measured" rather than defaulting to zero — is one of the more demanding tasks in systems engineering, because every downstream consumer must then be written to handle the null. The cheap thing is always to default. The honest thing is always to propagate the gap.

I learned the cost of this the hard way in 2022, during the winter that followed the collapse of FTX. I withdrew to the Victorian bushlands for six months, burned out and, frankly, humbled. What I wrote there — a private manifesto I called "The Myopia of Decentralization" — was an attempt to reckon with the fact that my own idealism had been a kind of default value. I had filled the field of "will this work" with "yes" because "yes" was the value the community expected, and I had not propagated the uncertainty that a more honest model would have required. The leak of that manifesto was painful. The lesson was not. I had confused the confidence of my convictions with the accuracy of my analysis, and the market had, in its patient way, corrected me.

The DeFi oracle landscape shows what it looks like when an industry takes provenance seriously, at least partially. Modern oracle designs increasingly do not present a single price. They present a price with metadata: the sources, the deviation, the update frequency, the confidence interval. A sophisticated consumer of a Pyth or Chainlink feed can see not just the number but the shape of the number's reliability. This is progress, and it is progress precisely because it admits that the number is a claim rather than a fact.

But here is where I part ways with the prevailing optimism, and where I want to test my own argument against its hardest case.

The trouble with provenance is that it can become its own theater. I have now sat in enough rooms to recognize the pattern: an institution discovers attestation, and within a quarter it has deployed a schema, a dashboard, and a policy, and the policy is that everything must be attested. The result is a landscape of signed claims, each with a verifiable origin, none of which is more true than it was before. You have added a cryptographic veneer to the same epistemic situation. The field is no longer empty; it is filled with a signed assertion that the field is empty, which is somehow worse, because now the emptiness has the authority of a signature.

I watched this happen, in miniature, with the pension fund I advised in 2024. When Bitcoin ETFs were approved and I was invited to help integrate crypto into a major Australian fund's portfolio, my negotiation centered on a clause directing five percent of the allocation toward open-source infrastructure. The traditionalists objected, and their objection was instructive. They did not dispute the value of the infrastructure. They disputed that the value could be measured, and they were right that the measurement would be a construction. Every metric we might attach to that allocation — returns, impact, risk — would be a chosen frame, and the frame would do more work than the data inside it. I pushed the clause through anyway, because I believe values must be operationalized even when they resist measurement. But I did not pretend the measurement was neutral. That would have been the theater.

The deeper contrarian point is this: more verification is not the same as more truth, and an industry that mistakes the two will build an ever more elaborate apparatus for confirming things that should never have been asserted in the first place. There is a version of the provenance future in which we all carry impeccable credentials for claims we had no business making, and the credentials make the claims harder to challenge, not easier. Attestation can be a tool of accountability or a tool of authority. The difference is whether the schema can express doubt about itself.

The most honest system is not the one that verifies the most, but the one that is most willing to return an error — and a market that punishes errors and rewards confident defaults will always choose the beautiful lie over the ugly null.

This is where my faith in decentralization gets tested, and I want to be honest about the test rather than resolving it too quickly. The promise of decentralization is that no single party can unilaterally assert what is true. But in the information layer, we have quietly re-centralized the assertion of truth in the hands of the parties who write the schemas and run the pipelines. The blank field is filled by whoever controls the default, and the default is a policy decision disguised as a technical one. A truly decentralized information layer would have to decentralize not just the verification of claims but the governance of what counts as a claim — and that is a problem no consensus mechanism has solved, because it is not, in the end, a mathematical problem.

So I return to the sentence I began with: we do not know. It is not a confession of weakness. It is the only foundation on which a durable system of trust can be built, because a system that cannot say "I do not know" cannot be trusted when it says "I do." The next decade of this industry will not be won by the protocol that verifies the most state, but by the one that is most disciplined about the boundary between state and information — the one whose dashboards return an error where they once returned a comfortable zero.

I will be watching for that boundary, and I suspect you will start to see it too. The question is not whether we can prove our claims. It is whether we can still recognize an empty field when we see one — or whether we have grown so accustomed to the certainty of filled boxes that we no longer notice the silence where the truth should have been.