Last Tuesday, in a bear market that has already drained forty percent of the liquidity from three of the rollups I track, a due-diligence pipeline handed me a nine-section report on a token. Every field read the same: N/A โ insufficient information. Technical architecture: N/A. Token supply: N/A. Team: N/A. Risk matrix: N/A.
The cause was mechanical. The first-stage parser had returned an empty array of information points. Nine downstream dimensions, each with its own template, each required to produce a verdict, propagated the void without a single exception.
The report was right. It refused to invent a project, a team, a TVL figure, or a vesting cliff. It said, in plain language, that an empty input is not a clean bill of health.
The humans downstream read it as 'nothing to worry about.'
That misreading is the most expensive failure mode in this industry, and it has nothing to do with smart contracts.
Every research product in crypto โ mine included โ is a two-stage machine. Stage one extracts atomic facts: a contract address, an audit firm, a supply schedule, a funding round, a timestamp. Stage two infers: is this solvent, is this decentralized, is this a security. The inference stage is where the prestige lives. The extraction stage is where the failures live.
We have spent four years building inference. Sentiment dashboards. Agents that read governance forums. Models that score 'narrative strength' on a five-point scale. In a bull market nobody audits the handoff between the two stages, because the handoff is invisible when the answer is bullish.
In a bear market the handoff becomes the whole story. Readers no longer want to know which protocol will 10x. They want to know whether the thing holding their stablecoins is going to be there on Friday. That question cannot survive a filled-in template built on an empty array.
The economics of the failure have also inverted. When prices rise, a hallucinated analysis costs you an entry. When prices fall, a hallucinated 'low risk' rating costs you the principal. Most of the tooling has not noticed the flip.
And automation is no longer optional. I track roughly sixty protocols. In one seven-day window, three changed their sequencer architecture, two restructured their treasury, and one quietly moved its admin keys to a new multisig. No human team reads that manually. The pipeline is the only reason the coverage exists at all.
Which is exactly why the null has to be handled correctly.
The pipeline did not fail by producing nothing. It failed by producing a shape โ nine headings, six risk categories, a five-star value rating โ and a shape invites filling. I have watched this happen in code reviews for twenty-five years, and I watched it happen in the 2026 AI-agent audit that ended my patience with the whole convergence narrative. An agent was autonomously executing contracts. The loss was twelve million dollars. When I traced the decision tree back to its implementation, the flaw was not in the model weights. It was in the fallback. When a required input was absent, the agent's policy did not halt. It substituted a default and continued.
Null propagation is not a reporting bug. It is an architectural choice about what a system does when it does not know. Every system has one. Most systems choose 'continue.'
The report I received chose 'halt,' and it chose the most useful form of halting available: it kept the skeleton and marked every bone as missing. That is correct design. A blank field is auditable. A plausible number is not.
The report even contained its own repair instructions. Below three atomic information points, the correct behavior is to reject the input at the gate โ not generate a template, not interpolate, not ask a language model to fill in what is likely. Three sourced facts is the minimum viable object for analysis. Below three, you are not analyzing. You are writing fiction in a citation format.
There is a measurable version of this. If a parser returns an empty array on more than ten percent of inputs of a given type โ long-form articles, paywalled pages, JavaScript-rendered dashboards โ the parser is broken, not the corpus. A hundred percent abstention rate on one document is a signal about that document. Confusing the two is how teams spend six months rebuilding the wrong component.
The semantic failure is worse. In every risk rubric I have audited, 'unknown' is scored as 'medium.' The logic is superficially reasonable: we cannot rule out harm, so we assign a middle value. The effect is systematic under-pricing of precisely the risks that matter. Unknown is not the midpoint between low and high. Unknown is the fat tail. It is the state in which you hold no evidence about the distribution at all.
I learned that in 2022, tracking LUNA's supply dynamics for three months before the collapse. The oracle feeds went quiet for hours at a time. The dashboards showed a stable peg because there was nothing to show. Missing data rendered as calm. I published a forensic timeline proving the system was insolvent rather than merely volatile, and the Monetary Authority of Singapore later cited it as evidence of a regulatory gap. The gap was not a missing rule. The gap was a missing number that everyone had agreed to read as a zero.
The same pattern sits in the Curve stableswap invariant I audited in 2020, before mainnet. The pool weight parameters produced exploitable rounding errors under high volatility. Under normal conditions those errors were invisible โ another way of saying the system looked safest precisely when it was least informative.
The report in front of me refused the conflation. It stated that N/A does not equal low risk, does not equal neutral, and does not equal a negative finding. That one sentence is worth more than nine pages of scoring, because a filled risk matrix is a claim about the world, while a matrix of N/A fields is a claim about your own knowledge. The second is falsifiable. The first is not.
Follow the coins, not the claims. And when there are no coins to follow, say so.
The institutional failure is the one I expect to be litigated. In early 2024 I audited the custody architecture behind the spot Bitcoin ETFs โ the multisig wallets at the two largest providers. The residual single points of failure I found in key management were documented. They were disclosed. They were scored as acceptable, because the rubric had no field for 'we know this is a weakness and we are proceeding anyway.' Regulators do not read that as acceptable. They read it as knowledge, and knowledge plus a bad outcome is a different legal category than ignorance plus a bad outcome. Code is law. Logic is lethal. The rubric that has no field for admitted weakness is the rubric that will be read aloud in a hearing.
Here is what the bulls got right, and I will give them the floor. The people building automated extraction are solving a real problem. Coverage at scale is not vanity. In a week where a protocol loses forty percent of its LPs, the question 'is my position still there' cannot wait for an analyst with a six-week backlog. The pipeline that produced my empty report is doing more for risk management than most of the research newsletters in my inbox, because at least it is honest about what it does not hold.
The critique is also routinely aimed at the wrong layer. The problem is not that models read governance forums. The problem is that nobody instruments the abstention rate. A system that says 'I don't know' ten percent of the time is more trustworthy than one that says it zero percent of the time, and we have built an industry that rewards the second. So the correction is narrow. Do not stop automating. Automate the halt.
The next twelve-million-dollar loss will not come from a reentrancy bug. It will come from a template that was filled in because a template existed.
Verification precedes trust โ including verification that you had something to verify. The ledger does not forgive a default value.
So here is the question I would put to every research desk, every dashboard vendor, and every agent shipping a risk score this quarter: of the reports in your inbox this week, how many were generated from an empty array, and how many of those did you read as green?