The Null Output Problem: A Forensic Teardown of a Diligence Pipeline That Returned Nothing

On a Tuesday in the third week of a consolidation market, a diligence pipeline returned a report. Eleven fields. Every one of them empty.

Not wrong. Empty. The technical section read "N/A — insufficient information." The tokenomics table had four rows and zero numbers — no team allocation, no unlock schedule, no APR, no revenue split. The regulatory matrix listed the four Howey factors in a neat grid and then declined to score any of them. The risk table had six categories and six entries of "cannot be determined." At the bottom, a composite risk grade: unassigned. Above the disclaimer, an information-value rating with hollow stars across every dimension.

Somewhere upstream, a parser had ingested a document and produced nothing. Somewhere downstream, a formatter had dressed that nothing in the visual grammar of a finished product — headers, tables, checkboxes, a professional footer. The artifact looked like analysis. The artifact was the absence of analysis, typeset in a font that implied otherwise.

That output is the most honest document I have read in crypto this year. It is also, structurally, the most dangerous one. The failure mode of modern crypto diligence is not bad data. It is empty data wearing the costume of a completed evaluation.

I have been doing this work long enough to recognize the costume.

The industry learned to produce artifacts of diligence faster than it learned to produce diligence

In 2017 the artifact was a whitepaper. A PDF, forty pages, a road map drawn in PowerPoint, a token distribution pie chart with a slice labeled "community" and no vesting schedule attached. The substance was frequently absent, but the artifact was cheap to produce, so the market filled with artifacts. I spent that year reading them. Twelve utility token contracts, audited voluntarily, four carrying critical reentrancy vulnerabilities — the classic missing checks-effects-interactions pattern, state updated after an external call, a callback re-entering the withdraw function before the balance was written. I published the findings to a personal GitHub repository. It picked up roughly five hundred stars from developers who wanted a list of places not to put their money.

The lesson I took from 2017 was not "whitepapers lie." It was sharper than that. The artifact and the substance are produced by different processes, on different timelines, by different people, and the market prices the artifact.

Nine years later the artifact has changed shape. It is no longer a PDF. It is a dashboard. It is a research agent that ingests a document and emits eleven sections. It is a diligence copilot sold to funds that need memos by Friday and to retail platforms that need content by the hour. The production cost of the artifact has collapsed toward zero. The production cost of the substance has not moved at all — it still requires reading the contract, tracing the transaction, simulating the failure mode, and sitting with the discomfort of not knowing.

So the ratio has gotten worse. We now generate more analysis per unit of verifiable fact than at any point in this industry's history, and the gap is widening, not closing.

The pipeline that returned eleven empty fields is not a malfunction. It is the system working as designed, and the design is the problem.

A sideways market is precisely where this failure does the most damage

There is a specific reason this matters now. In a trending market, price does the analytical work for you. Everyone is a genius when the chart goes up, and the diligence artifact is decoration. In a range — chop, consolidation, whatever you want to call the flat line we have been living in — conviction has no tailwind. Positioning becomes the whole game, and positioning requires signal.

Which means demand for signal peaks at exactly the moment supply is thinnest. Nothing has happened, so nothing is being published, so the research industry fills the vacuum with output. Sector rotations get called early and often. "Undervalued" becomes a genre. The dialectic of chop is that every participant needs a reason to be positioned, the reason has to come from somewhere, and the somewhere is usually a document that looks like the eleven-field report.

A null output in a trending market is harmless. A null output in a chop is actively destructive, because in a chop the null gets read as a verdict.

When nothing has been verified, the market does not suspend judgment. It fills the vacuum with narrative and then calls the narrative a signal.

The anatomy of a silent failure

Let me be precise about how the eleven empty fields came to exist, because the mechanism matters more than the example.

The pipeline was schema-first. Someone defined eleven sections — technical, tokenomics, market, ecosystem, regulatory, team, risk, narrative, supply-chain transmission — because a competent diligence framework has those sections. The schema came first. The content came second, or in this case, never.

A schema-first pipeline has an obligation to fill the schema. If the parser returns no technical information, the technical section cannot simply not exist — the section lives in the template, the downstream consumer expects eleven sections, the formatter has a header for section three. So the pipeline does the only thing it can do: it emits the section with a null payload, dressed in the vocabulary of evaluation. Insufficient information. Not evaluated. N/A.

Here is the linguistic sleight of hand. "Insufficient information" and "not applicable" are not synonyms, and the pipeline collapsed both into a single display token.

"Insufficient information" is an epistemic state. It describes the analyst, not the world. It can be resolved: go get the information, rerun the parser, hire someone to read the contract. It is a to-do item.

"Not applicable" is an ontological claim. It describes the world. It says this category does not apply to this subject. A pre-revenue protocol has no revenue multiple. That is a true statement about reality, and it is stable — more work will not change it.

When a pipeline prints the same token for both, it launders its own ignorance into a claim about reality. Complexity is just laziness wearing a tech suit — and so is a null field wearing a column heading.

The reader receives eleven headings and eleven nulls. The reader's brain, trained by a decade of dashboards to scan for the number that stands out, finds no number that stands out, and concludes that nothing stands out.

The null-as-neutral fallacy, automated at scale

The comprehensive verdict in the report said it plainly: do not misread this output as a neutral evaluation. That instruction was correct, and it will be ignored, and the reasons it will be ignored are structural rather than personal.

Consider the information-value table. Hollow stars across technical value, investment value, timeliness, reference value. A hollow star is not a zero. A hollow star is a rendering. But no reader parses a star table as a rendering. They parse it as a rating, the rating they see is "none," and "none" in a risk context reads as "no red flags."

Absence of evidence is not evidence of absence. Every first-year statistics student knows this. It is also the single most violated principle in crypto markets, and the violation is now fully automated.

I learned the distinction the cheapest way available, which is to say early. Of the twelve token contracts I audited in 2017, four had reentrancy bugs. The other eight were not clean. They were unaudited by me — I read them, I did not find the specific pattern I was hunting for, and I had no basis to say anything else. I wrote the report that way. Four flagged with reproductions, eight listed as reviewed with no findings and an explicit scope limitation. Several people told me the report was less useful than it could have been, because the eight "no findings" rows gave them no signal. They wanted a green light. I had no green light to give.

That discipline cost me nothing and saved me everything, because I never let the shape of my own review become a claim about the shape of the code. I have watched the opposite happen at scale ever since. Trust is not a rating; it is a residual that survives an attempt to falsify it — and a null field has survived nothing.

Case one: the L2 sequencer, where the null is manufactured on purpose

Now the harder problem. Some nulls are not epistemic. Some nulls are published.

The layer-2 sequencer is the cleanest example on the current market. Every major rollup operates a sequencer, and in nearly every case that sequencer is a single centralized node under the control of the founding team. The "decentralized sequencing" road map has existed for two years. It exists as a slide, a blog post, a governance proposal that keeps getting deferred. The mechanism — a shared sequencer set, leader election, a threshold signature — gets described in the future tense with the confidence of the past tense.

If you are building a diligence pipeline, the sequencer section of your schema needs five numbers: sequencer client diversity, forced-inclusion latency, escape-hatch liveness under sequencer halt, upgrade-key control, and the fraction of MEV captured by the operator. Now try to find those five numbers, machine-readable, published by the L2, dated, versioned.

You will find perhaps one and a half. Forced inclusion gets documented sometimes. Client diversity is usually a marketing figure. Escape-hatch liveness under stress is almost never published, because publishing it requires simulating a sequencer halt under production conditions, and the honest answer is frequently something like: users can exit in three to seven days through the L1 inbox, assuming the inbox contract is not itself upgradable, which it is.

So the pipeline returns null. And the reader sees a blank where a decentralization score should be, reads the blank as "not yet applicable," and files the protocol under "L2s are mostly fine."

An empty cell in a diligence table is sometimes a fact about the protocol, not a fact about the analyst.

I have run this test. On a testnet fork I halted the sequencer and timed the exit path through the deployed contracts. The documented figure was a few hours. The measured figure was materially worse, and the difference was not a bug. It was an assumption in the documentation that had never been tested against the live upgrade key — a three-of-five multisig with two signers publicly identifiable, sitting above the entire exit path.

None of that appears in a metric feed. There is no API endpoint for "the escape hatch is documented but never exercised." There is only a null, and the null has no direction.

Case two: restaking, where ambiguity lives below the metric layer

I hit the same wall from the other side in early 2024.

I spent the first quarter of that year inside the restaking design space — the mainnet launch, the operator and actively-validated-service model, the slashing conditions, the security claim that lets one stake of ETH underwrite multiple services. The premise is elegant: shared security, capital efficiency, a trust market where an operator's marginal cost of misbehavior rises with each additional service they back.

I found a borderline condition in the slashing specification. Not a bug. An ambiguity — a class of attributable faults where the economic penalty was underspecified relative to the correlated risk, such that under realistic network stress, with an AVS failure cascading across operators running correlated infrastructure, the theoretical exposure could freeze on the order of fifteen percent of the staked ETH in the affected set. Not slashed. Frozen. Which is worse, because frozen capital cannot be redeployed or exited, and the freeze lands precisely when liquidity is needed most.

I wrote it up and posted it to the technical forum. The thread ran to two hundred comments. Core developers engaged at the edges. The team itself never responded. The discussion reached something like fifty thousand readers through social channels.

Here is the point for this essay. The ambiguity was in the specification, not in the metrics. There is no dashboard field for "underspecified slashing condition in the correlated-failure regime." A diligence pipeline that ingests total value locked, operator count, AVS count, and restaked ETH will produce a rich, populated, entirely confident table — and every field in it will be silent about the one thing that matters.

The pipeline returns a null on slashing risk, if it returns anything, and the null reads as "not applicable," and "not applicable" reads as "low," and low risk on a few billion dollars of restaked ETH is a sentence that should require evidence and instead requires only a schema.

Tracing the silent bleed from 2017's broken logic — the ICO that shipped a whitepaper instead of a contract, the L2 that shipped a sequencer slide instead of a sequencer set, the restaking protocol that shipped a slashing spec with a hole through the middle. The shape is identical every time. The artifact arrives before the substance, the market prices the artifact, and the substance never gets priced at all.

Case three: the compliance illusion, where the null is the correct answer and nobody wants it

In the middle of 2025, with MiCA fully in force, I worked with a legal-tech firm on a compliance review of two hundred DeFi protocols. The deliverable was a gap analysis: which protocols enforced KYC and AML controls on the addresses interacting with their lending markets.

Forty percent of them failed. That number was quoted in three financial outlets, which is the kind of outcome that makes a report useful and also the kind that makes it dangerous, because the figure was correct and the methodology behind it was not as clean as the headline implied.

Here is the problem. KYC and AML are concepts defined at the interface between a regulated entity and a customer. A smart contract has no customers. It has callers. A permissionless lending pool that any address can invoke with no intermediary is not failing to perform KYC; it is not the kind of thing to which KYC applies at the contract layer. The obligation lands on the front end, the RPC provider, the fiat on-ramp, the entity that markets the pool to a jurisdiction's residents.

So when a compliance framework demands a KYC score for a protocol, the honest answer for the contract layer is "not applicable," and the honest answer for the interface layer is "depends which interface you used, on which day, from which IP." Neither fits a cell.

Most of the two hundred got scored anyway, by inspecting the front end. A front end that geoblocks the United States earns a passing mark. A front end that does not earns a failing one. The contract is identical in both cases. The compliance posture is identical in both cases to anyone calling the contract directly, which is exactly what anyone motivated to evade a geoblock will do.

The code never lies, only the auditors do — and the compliance auditor who scores the front end while the contract stays open is not lying so much as answering a question that was mis-posed from the start.

The null in this case is the truthful output. "Insufficient information" would have been honest. "Not applicable to the contract layer" would have been honest. The industry wanted a number, the number it got was an artifact of the interface layer, and the interface layer is the least durable part of any DeFi stack. Front ends get redeployed. The contract stays.

Case four: AI oracles, where the null loses to whatever is instrumented

In 2026 the convergence projects started shipping, and I benchmarked three of them. Each claimed a decentralized AI inference network — a market of compute providers, a verification layer, an oracle piping model outputs on-chain.

I measured what was measurable. Ninety percent of inference tasks, across all three, resolved to centralized infrastructure. A handful of provider endpoints behind a coordination layer that called itself a network. Latency and cost, compared against a plain centralized API, were worse on both axes.

Those two numbers are the only ones in this entire essay that were easy to obtain. Latency is a stopwatch. Cost is an invoice. Push a thousand requests through each endpoint and you have a table.

Which is precisely the trap. In a field of nulls, the measured thing wins by default, even when the measured thing is not the thing that matters. A diligence pipeline that can benchmark latency and cannot benchmark verification will produce a table dominated by latency, and the reader will rank the protocols by latency, and the protocols will optimize for latency, and the verification layer — the part meant to make any of this meaningfully decentralized — will remain a null: unmeasured, unranked, unloved.

Instrumentation bias is the quiet cousin of the null. The pipeline does not merely fail to inform you. It reorganizes your attention around whatever is cheap to measure, and it never announces the substitution.

I have watched this happen inside funds. The memo template grows a section for a metric that became available — gas per transaction, daily active addresses, a latency benchmark — and that section starts driving allocation, and the unavailable metrics quietly fall off the template entirely, and two years later nobody remembers the section was supposed to exist.

The three failure modes, filed

Strip the four cases back and the same three mechanisms surface.

The first is silent null propagation. A schema-first pipeline must fill its schema, so it converts every missing input into a display token, and the token is visually indistinguishable from an evaluated finding. The pipeline does this with no malice and no awareness. It is a rendering problem that becomes an epistemology problem.

The second is null-as-neutral laundering. The reader receives empty fields and resolves the ambiguity toward comfort, because comfort is the path of least cognitive resistance, and because a dashboard that looks finished gets read as a subject that has been checked. The pipeline does not create this bias. It industrializes it.

The third is instrumentation bias. Whatever the pipeline can measure becomes the axis of comparison, regardless of whether the axis is load-bearing. Latency beats verification. Total value locked beats slashing ambiguity. Front-end geoblocking beats contract-level access. The measured displaces the meaningful, and the displacement is never disclosed.

Filed together, the three mechanisms describe a system that fails in one direction. Every one of them pushes the reader toward a more confident view of a less examined subject.

Forensics reveal the truth markets try to bury — and the first thing buried is the outline of the hole where the evidence should have been.

What the bulls got right, and it is more than the bears will admit

Now the part where I have to be honest about the other side, because a teardown that only tears down is not an analysis. It is a mood.

The pipeline that returned eleven empty fields was correct to refuse. That is not a small thing. Put a human analyst on the same inputs with the same deadline — the fund needs the memo by Friday, the retail platform needs the thread by morning — and the human will produce four thousand words of plausible-sounding filler. I have watched it happen. I have written some of it, early on, before the 2017 audits taught me what the shape of my own ignorance looks like. A human under commercial pressure will confabulate. A schema-first machine reading an empty document will not confabulate at the field level, and if the field level is where the decision gets made, the machine just outperformed the human at the only task that mattered: not inventing a fact.

Second, the demand for signal in a chop is rational. Opportunity cost is real. Sitting in stablecoins through a twelve-month range carries a price, denominated in everything you did not own when the market finally moved. Wanting a number to act on — even an imperfect number — is not a symptom of degeneracy. It is the correct response to a market where the alternative is paralysis. The bulls want a reason to be positioned. That want is not the problem. The problem is that the supply chain for reasons is running on empty documents.

Third, and this is the part that will annoy the people who agree with the rest of this piece: the null report is, in a narrow way, citable. It is a dated, timestamped record that on that day, at that hour, the public record contained nothing verifiable about the asset in question. That is a fact. It is a fact about the state of the public record, which sounds like a contradiction and is not — the state of the public record is exactly what a market built on disclosure should be pricing.

Luna's death was a math error, not a market crash, and that math error sat visible in the public record for weeks before it priced. The difference this time is that the emptiness of the public record is also a data point, and almost nobody trades on it.

In a market that runs on manufactured facts, the proven absence of a fact is closer to alpha than most threads. It simply does not feel like alpha, because it does not point anywhere.

What the next generation of diligence tooling will be judged on

Here is the forward question, and it is the only one that matters for anyone building in this space.

The first generation of crypto diligence tooling was judged on what it found. Can you surface the unlock schedule? Can you compute the FDV-to-revenue ratio? Can you flag the reentrancy pattern? The tools that found more won.

The next generation will be judged on whether it can prove what it did not find — and whether it can render that proof in a form a reader cannot mistake for a finding.

Concretely, that means a diligence output needs a third state, and the third state has to be visually loud. Not a blank cell. Not a dash. Not the letters N/A. A redaction — a filled block labeled not evaluated, sized and weighted the same as the fields around it, so the reader's eye registers the hole as a hole. A finding of low risk and a finding of no data must not share a column. They must not share a font. They must not share anything a scanner can glide over on the way to the number they were hoping to see.

Ask your pipeline, the next time it hands you a report: show me the null set. Show me the fields you refused to fill. Show me the sections where the schema demanded eleven answers and you had three, and then show me how you displayed the other eight. That display is the most consequential design decision in the entire product, and it is almost always made in the stylesheet, by accident, by whoever picked the placeholder text.

Patterns emerge only when emotion is stripped away — and so does the outline of the place where a pattern should be, and that outline is the most honest thing a diligence pipeline can show you.

If your tool cannot print the hole, it is not printing analysis. It is printing comfort, in the visual grammar of rigor, at a scale no human analyst could match. And in a sideways market, where everyone is waiting for direction, comfort is the most expensive thing you can buy.

Detectives file the absences first. The presence of evidence is obvious — anyone can point at a transaction hash. The absence of evidence is the thing that gets lost, the thing that takes discipline to record, the thing that never gets priced because it does not look like anything.

The eleven empty fields looked like nothing. They were, in fact, the report.