The N/A Report: Nine Dimensions of Due Diligence and the Economics of Filling Blanks
Hook
Last month a parsing pipeline returned empty.
I had run a nine-dimension due diligence framework — technical, tokenomics, market structure, ecosystem position, regulatory exposure, team and governance, risk, narrative, and supply-chain transmission — against a bundle of input documents. Stage one, the extraction layer that pulls claims, entities, and time-sensitive facts out of raw text, produced nothing. Not an exception. Not a timeout. Not a truncated response. An empty array.
Stage two did what it was built to do. It ran the framework anyway. Nine dimensions. Every field populated with the same three words: insufficient information. The risk matrix had six rows and six empty cells. The Howey test had four elements and no verdict. The supply-chain map had three tiers and no nodes. The team table had three columns — technical capability, industry experience, stability — and nine blanks.
I have read somewhere north of four hundred crypto research reports in the past eighteen months, most of them published by funds with more than a billion dollars under management, several of them circulated to me under embargo with the expectation that I would repeat their conclusions. That empty document is the most honest one I have encountered. It is the only one that refused to lie.
I want to use it as a mirror. Not because the document matters — it does not, it is a null result from a broken pipeline. I want to use it because what it refuses to do is precisely what the rest of the industry does for money, at scale, every single week of this bull market.
Context: The Research Economy in a Bull Market
Research in a bull market is not a cost center. It is a marketing line item with a research-shaped wrapper.
Trace the money and the function becomes obvious. A token foundation pays an agency for a "deep dive" that lands on a tier-two exchange's research portal, which the exchange monetizes as listing content, which the foundation quotes in its next raise. A fund pays a junior analyst to produce a thesis that justifies a position the fund has already taken, so that the thesis can be shown to LPs as evidence of process. A KOL with a Substack and no audit experience publishes a "fundamental analysis" whose primary input is the project's own documentation, lightly reworded, with a price target attached. Nobody in that chain is paid to be right. Everybody in that chain is paid to be quotable.
I have been on both sides of this. I spent three years as a quantitative analyst at a firm that sold research to institutional allocators, and the single hardest conversation I ever had was explaining to a sales director why a report I had written concluded that a client's flagship holding was structurally unsound. The report was never published. The relationship was preserved. That is how the industry handles negative findings: it absorbs them as private information and publishes the positive ones as public goods.
The second structural feature of this cycle is the collapse in the cost of producing a plausible claim, while the cost of verifying one has not moved. In 2019, generating a thirty-page protocol analysis required a human who could read Solidity, build a discounted cash flow analogue, and write English. In 2026, the first two of those three tasks are automated to a quality that passes casual inspection. The third is automated to a quality that passes casual inspection and fails expert inspection. Verification — actually reading the bytecode, actually reconciling the on-chain supply against the stated supply, actually running the unlock schedule against the emission schedule — still costs the same three weeks it cost in 2019, because it is bounded by human attention and by the number of hours in a day.
The cost of producing a plausible claim collapsed; the cost of verifying one did not. Everything ugly in this market is downstream of that asymmetry.
The empty document in my pipeline is the honest response to that asymmetry. It says: I have no verified input, therefore I will assert nothing. The industry's response is the opposite. It says: I have no verified input, therefore I will assert everything, and I will format the assertion so that it looks like a finding.
What follows is a teardown of nine places where that formatting happens. I am using the same nine dimensions the empty framework used, because the framework is not the problem. The framework is fine. The problem is what gets poured into it.
Core: Nine Places Where Blanks Get Filled
1. The Audit Is a PDF, Not a Property
A project announces it has been audited. The community reads that as a safety guarantee. What has actually happened is that a firm with a recognizable logo spent two to six weeks reading a snapshot of a codebase that has since been modified, under a scope that excluded the upgrade mechanism, for a fee paid by the project being audited, and produced a document whose findings were negotiated before publication.
I do not trust the audit; I trust the exploit.
The distinction is not cynicism. It is a statement about what each artifact proves. An audit proves that a set of humans looked at a set of files at a point in time. An exploit proves that a specific sequence of transactions against the deployed bytecode produces an unauthorized state transition. Only one of those is a fact about the system.
In 2017 I audited the ICO of a prominent Asian utility token and found an integer overflow in the vesting contract. The arithmetic was not subtle. The contract stored vesting amounts as unsigned integers and multiplied by a rate derived from the token price; under a specific price input, the multiplication wrapped, and the beneficiary's claim became effectively unbounded. Early investors could have drained roughly 40% of total supply. The project had been audited. The audit had covered the token contract, not the vesting contract. The scope excluded the exact file that contained the bug.
I published a GitHub issue. The project devalued within days. I left mainstream crypto for two years and went back to applied mathematics, because I had learned something that took a while to metabolize: the market does not reward the finding. It rewards the timing of the finding relative to the position of the person reading it. I was early, and early is indistinguishable from wrong until it is not.
The mechanical lesson is narrower and more useful. When you read an audit, do not read the conclusion. Read the scope table. Read the list of excluded contracts. Read whether the deployed bytecode matches the audited commit hash. In 2026 the third of those checks is the one that fails most often, because the standard practice now is to audit a commit, deploy a proxy, and upgrade the implementation after listing. The audit remains on the website. The code it described is gone.
The transaction is permanent; the mistake is not.
2. Tokenomics Is an Unlock Schedule Wearing a Business Model
Every token model I have examined in this cycle reduces, after you strip the vocabulary, to four numbers: total supply, circulating supply as of today, the emission rate per block or per epoch, and the cliff schedule. Everything else — the "flywheel," the "value accrual mechanism," the "governance utility" — is narrative laid over those four numbers.
The blank-filling happens in the definition of circulating supply. I have seen projects report a circulating figure that excludes team tokens which are technically unlocked but held in a multisig the team controls, excludes treasury tokens which are "not intended for sale" but are pledged as collateral in a lending market, and excludes ecosystem tokens sitting in a contract that the team can drain at will. Under a strict definition, the real free float was 40% to 60% lower than the reported figure. The reported figure is the one that feeds the market cap that feeds the listing metrics that feed the index inclusion that feeds the passive flows.
Then there is the incentive layer, which is the part I have spent the most hours simulating. Liquidity mining APY is not yield. It is a subsidy with a price. The headline number is emissions per unit time divided by deposited value, annualized. That arithmetic is correct and completely uninformative, because it treats the emission as free. It is not free. It is paid in a token whose marginal supply is increasing, to depositors whose capital is rentable, against a pool whose composition drifts.
I built a Python model of this in 2020, simulating Uniswap v2 constant-product pools under a range of volatility inputs. The result I did not expect was not the impermanent loss curve — that is textbook. It was the asymmetry. For a large depositor entering a volatile pair, the divergence loss crossed a threshold near a 15% price move that wiped the entire fee accrual for a retail-sized LP, while a depositor with enough capital to hedge externally could neutralize it. The subsidy was flowing from the small and unhedged to the large and hedged. That is not a design flaw. That is the design.
When the emissions stop, the deposited value does not decay smoothly. It decays to the sticky fraction — the portion of TVL that is there for reasons other than the emission. In the pools I have tracked across three cycles, the sticky fraction is typically between 8% and 20% of peak. The rest is mercenary capital that has a cost of carry and leaves when the carry goes to zero.
The code compiles, but the reality bankrupts.
3. Market Structure: Price Is a Function of Attention and Attention Is a Function of Price
Here is where the bulls and I diverge least, and where most bearish analysis embarrasses itself.
In a market where the asset has no cash flow, the discount rate is not derived from earnings. It is derived from the expected future supply of buyers. That supply is a function of attention, and attention is itself a function of price. The loop is reflexive and it is measurable, and pretending it does not exist is how analysts end up being right about fundamentals and wrong about everything that matters for eighteen months.
What the blank-filling does in this dimension is confuse liquidity with depth. A token can show a billion dollars in daily volume and still be unexitable by a position of any size, because the volume is wash trading between wallets the same entity controls, or because the depth is concentrated in a single market maker operating under an agreement that terminates on notice. I have pulled order book snapshots for tokens with nine-figure market caps and found that the top three bid levels contained less than 0.3% of the reported daily volume. The volume was real. The exit was not.
The second confusion is funding rates. A persistently positive funding rate is read as bullish conviction. It is more accurately read as a measure of how much leverage is being paid to remain long. In a bull market, funding can stay positive for months, and that is not evidence against the thesis — it is evidence that the trade is crowded and that the unwind, when it comes, will be mechanical rather than fundamental. Mechanical unwinds do not check whether the underlying protocol shipped its roadmap.
I am not making a prediction about price. I have never made a useful one. I am making a statement about what the data in this dimension can and cannot support. Volume tells you about the cost of entering. It tells you almost nothing about the cost of leaving, and nothing at all about whether the thing you are buying does what it claims.
4. Ecosystem Position Is Usually Someone Else's Balance Sheet
Every protocol in this cycle claims to be "composable infrastructure." Composability is real. It is also the mechanism by which a single failure propagates across a dozen balance sheets that each believed they were diversified.
The blank-filling in this dimension is double counting. I have reconstructed ecosystem maps where the same dollar of collateral appeared in four protocols' TVL figures: deposited into a lending market, whose receipt token was deposited into a yield aggregator, whose position token was used as collateral for a stablecoin, whose supply was counted as liquidity in a DEX pool. Each protocol reported the full amount. The aggregate "ecosystem TVL" was roughly 2.7 times the underlying capital.
This is not fraud in the legal sense. Every individual reporting decision is defensible. The aggregate is not, because the aggregate is the number that gets quoted in the raise deck.
The second blank is dependency direction. A protocol that lists twenty integrations looks well-connected. What matters is how many of those integrations would survive if the protocol's own token lost 70% of its value. In the maps I have built, the answer is usually one or two — typically the ones where the integration is a fee payer rather than a depositor.
The third blank is developer signal. Commit counts are gameable, contributor counts are gameable, and both have been gamed at industrial scale since 2023. The signal that has held up in my own tracking is contract deployment from addresses that have never received a grant, never interacted with the treasury, and never appeared in a governance forum. That population is small and it is the closest thing to an honest measure of whether anyone outside the payroll finds the thing useful.
5. Regulatory Exposure Is a Timing Trade, Not a Moat
Every serious token issuer in this cycle has a legal opinion. Most of those opinions are correct about the law as written and wrong about the law as enforced.
Run the Howey elements against any token with a foundation, a treasury, a roadmap, and a marketing budget, and you get a set of answers that are uncomfortable but not ambiguous. Money invested: yes. Common enterprise: yes, the foundation is the enterprise. Expectation of profit: stated in the marketing. Derived from the efforts of others: the roadmap is the efforts of others. The blank-filling happens at the fourth element, where the analysis pivots to "sufficient decentralization" — a standard that has never been defined by any regulator and has been used by every issuer to mean "decentralized enough that we would prefer not to be asked."
In 2022 I spent two months reverse-engineering TerraUSD and submitted a forty-page technical report to regulators in Singapore. The report did not argue that UST would fail because of sentiment or because of a bank run. It argued that the seigniorage mechanism required demand for LUNA that grew geometrically with the size of the peg, and that no finite liquidity pool could satisfy that requirement under sustained redemption pressure. The math was not exotic. It was a statement about the growth rate of a required variable versus the growth rate of an available one.
The report was largely ignored. The mechanism failed the way the model said it would, months later, and the failure was attributed to a coordinated attack rather than to the structure. That attribution is the blank being filled in real time: a structural inevitability retrofitted as an exogenous shock.
The usable lesson for this cycle is that regulatory clarity is a schedule, not a property. A project that is compliant today because no regulator has looked at it is not compliant. It is unexamined. Those are different states with different risk profiles, and the market prices them identically until it does not.
6. Governance Is a Multisig With a Timelock Someone Can Bypass
The governance dimension is where the most confident claims rest on the thinnest evidence.
A project publishes a governance page showing a DAO, a proposal process, a quorum, and a timelock. What is usually true underneath is that a multisig of five to nine addresses controls the upgrade path, that those addresses are held by the founding team plus two friendly funds, that the timelock has an emergency bypass guarded by the same multisig, and that the quorum is measured against a token supply in which the team and investors hold a majority that has never voted against a team proposal.
I have watched a governance forum where the top ten addresses held 71% of the voting supply and turnout on the four most consequential proposals of the year ranged between 3% and 9% of eligible votes. The proposals passed. The forum discussion was substantive. None of that changes the arithmetic.
The team dimension is worse, because the market has learned to accept anonymity as a neutral fact. It is not neutral. An anonymous team has no reputational cost to a rug pull, no legal exposure to a securities action, and no career penalty for abandoning a codebase. In my sample of projects that failed to deliver their mainnet within twelve months of a raise, the anonymous teams failed at roughly twice the rate of the doxxed ones, and the anonymous ones abandoned the repository entirely about three times as often.
In 2026 I ran a penetration test against a decentralized compute network that marketed itself as censorship-resistant AI training infrastructure. The consensus layer used a node reputation score derived from uptime attestations. The attestations were signed by the nodes. I spun up a bot farm, registered roughly five thousand synthetic identities across as many IP addresses from a residential proxy pool, and within eleven days held enough attestation weight to influence which training jobs were assigned and which were dropped. The operator list, published as evidence of decentralization, was a single entity with a proxy budget.
I do not report that story as an exposé. I report it as a default. The blank in the governance dimension is filled with the word "decentralized," and the word has no operational definition that survives contact with a bot farm.
7. The Risk Matrix Ranks Known Risks and Discovers None
Risk frameworks are useful for the same reason checklists are useful in aviation: they prevent the repetition of known failures. They are useless for the thing investors actually need, which is advance warning of an unknown failure.
The blank-filling here is structural. A risk matrix has rows. The rows were written by someone, at some point, based on a set of risks that had already been observed somewhere in the industry. A risk that has not yet occurred does not have a row. Therefore it cannot be ranked, mitigated, or flagged. The matrix will show green across the board right up until the event that was not on the list.
This is why post-mortems of every major failure in this industry read identically: the failure was in the assumption set, not in the risk register. Terra's register had a row for "sustained redemption pressure" and rated it low probability, because the model assumed the redemption pressure would be met by demand for the sister asset. The row existed. The dependency underneath the row did not.
What I do instead, and what I recommend, is to invert the exercise. Do not enumerate risks. Enumerate the assumptions that must hold for the thing to work, then ask what happens if each one fails, and then ask which of those failures is self-reinforcing. In my experience, the self-reinforcing failures are almost always the ones that depend on a price. Price-dependent assumptions are the ones that do not degrade gracefully. They snap.
8. Narrative Is a Derivative With No Underlying
Social volume and on-chain volume are different quantities, and in this cycle the ratio between them has become an asset class of its own.
I have tracked projects where social mentions grew by a factor of twenty while daily active addresses grew by 4%. The gap was the product. The gap was also the only thing being bought.
In 2021 I analyzed the metadata of a top-tier PFP collection with ten thousand items. The rarity table published on the project site assigned trait frequencies that implied a uniform random draw. The actual generation used a seeded pseudorandom function with a seed derived from the collection index, which meant the trait distribution was deterministic given the seed and heavily weighted toward a small set of procedurally generated combinations. Roughly 85% of the "rare" traits were artifacts of the generation order, not statistical rarity. I published the hash function analysis. The floor dropped 60% within a week.
That outcome was not a vindication. It was a demonstration of something more uncomfortable: the price had never been a function of rarity. It had been a function of the belief in rarity. Removing the belief removed the price, which means the price was never attached to the underlying at all. Illusion has a price tag; truth has none.
The same structure now sits under most of the narrative-driven sectors in this cycle. The narrative is not a claim about the world that can be tested. It is a coordination device. Coordination devices work. They also have no floor, because there is nothing underneath them to catch the price when the coordination stops.
9. Supply-Chain Transmission: The Halving Was a Revenue Event
Bitcoin's fourth halving cut the block subsidy to 3.125 BTC. The standard framing treats this as a supply shock and models the price response. The framing that matters operationally is simpler: it cut the revenue of every miner on the network by half, in a business with a fixed cost base denominated in fiat and a variable revenue denominated in a volatile asset.
The fee market did not replace the subsidy. In the blocks I sampled across the months following the halving, fees accounted for a low-double-digit percentage of miner revenue on ordinary days and spiked above the subsidy only during congestion events that lasted hours. A miner cannot build a capital plan on a congestion event.
What follows from that is consolidation, and consolidation in mining is not a metaphor. It is hash rate moving to the operators with the cheapest power contracts, the newest ASICs, and access to capital markets. The pools that aggregate that hash rate are a smaller set than the mining operators themselves. In the distribution I have tracked, three pools have at various points controlled a majority of network hash rate, and the operators behind those pools overlap in ways that are not visible on the dashboard.
This is the dimension where the industry's founding claim — that the network is decentralized because anyone can mine — has degraded the most quietly. Anyone can mine. Almost nobody can mine profitably at scale. The consensus is secure because attacking it is expensive, and it is expensive because the hash rate is concentrated, and it is concentrated because the subsidy halved and the fee market did not fill the gap.
Contrarian: What the Bulls Got Right
I have spent most of this article describing a machine that fills blanks with narrative. It would be dishonest to leave the impression that the machine is simply wrong, because it is not. It is frequently right, and it is right for reasons that bearish analysis consistently fails to model.
Reflexivity is a real mechanism, not a delusion. If attention drives price and price drives attention, then a project with no revenue and no users can still be a correct trade for a defined period, because the trade is not a claim about the project. It is a claim about the loop. People who understand this and size accordingly do well. People who call it a bubble and short it do poorly, and then call the market irrational to avoid updating.
The second thing the bulls get right is the cost of being early. I learned this the hard way in 2017. Being correct about a contract bug eighteen months before the market cares is economically identical to being wrong, and it costs you your access to the information you were using. The bulls who ignore the technical teardown are not necessarily lazy. Some of them have correctly concluded that the teardown has no pricing power within the time horizon they trade.
The third thing is subtler. Narrative is not always a substitute for fundamentals. In a market where the primary product is coordination, narrative is the product. A chain that convinces more projects to deploy on it than its competitor has, in a literal and measurable sense, a better product — not because the technology is better, but because the deployment count is the thing that compounds. That is why the contest between the major rollup stacks has never been decided by proving which proof system is more elegant. It is decided by business development, and the stack that wins the deployment race will be described in hindsight as having won the technology race, and the description will be wrong and the outcome will be real.
Which brings me to the actual weakness of my own position. The empty report is honest, and honesty has a failure mode: it can become a machine for producing N/A. Nine dimensions of insufficient information is not analysis. It is a refusal, dressed as rigor. A framework that only outputs when the input is perfect will output almost never, and the market does not pay for abstention. The discipline I actually need is not the discipline of refusing to fill blanks. It is the discipline of labeling which blanks I filled and with what.
Takeaway
The useful question is not whether a claim is true. It is who paid for the claim, what the claim costs to verify, and what happens to the person who verifies it.
Run that question against the next research report you read in this bull market. Check whether the circulating supply figure reconciles to the chain. Check whether the audited commit hash matches the deployed bytecode. Check whether the ecosystem TVL double counts a dollar that is already counted somewhere else. Check whether the governance page's quorum has ever been tested by a proposal the team opposed.
If the report survives those four checks, it is worth more than the four hundred I have read. If it does not, you have learned the only thing the document was ever going to teach you — and you learned it before you paid for the privilege.
