The Null Pointer: What 47 Fields of N/A Reveal About Crypto Due Diligence
Hook
A 4,100-word Stage Two Deep Analysis Report landed in a mid-size fund's deal channel last month. Nine analytical dimensions. Forty-seven structured tables. A risk matrix with six categories and four probability columns. A five-star information-value rating. A glossary. A disclaimer.
Every substantive field was marked "information insufficient โ unable to assess."
The fund's intake checklist had fourteen items. The report scored fourteen out of fourteen. It was archived as complete, tagged, and stapled to a position-sizing memo recommending a two-million-dollar entry.
That is the finding. Not a reentrancy. Not a depeg. Not a bridge drain. A document that consumed an analyst's morning and produced zero bits of transferable information, and passed review because its shape was correct.
I have spent the better part of two decades reading project documents. In 2017 I read whitepapers. By 2021 I read audit reports. In 2026 I read the metadata of audit reports. The substrate keeps getting abstracted away, and what remains is the format. The format is now the product.
Context
The industrialization of crypto due diligence did not come from a demand for truth. It came from a demand for coverage.
After the FTX collapse in November 2022, allocators woke up holding assets they had never technically examined. The response was organizational, not technical. Committees were formed. Vendor lists were drawn. Every fund above a certain AUM needed a paper trail proving that capital had been deployed with diligence. The deliverable was never the analysis. The deliverable was the artifact proving the analysis happened.
Between 2022 and 2025, the number of firms selling blockchain research โ as opposed to research in blockchain โ expanded by roughly an order of magnitude. Most of them did not produce findings. They produced frameworks: seven-dimension, nine-dimension, twelve-dimension templates with required fields, scoring rubrics, and confidence bands. A template is cheaper to sell than a finding, because it can be applied to every asset and never be wrong.
Then the bear market arrived and cut the budgets that fund real work. When research spend contracts, the first thing cut is the part that takes six weeks and produces one number. What survives is the part that produces one hundred pages in one afternoon. The artifacts degrade exactly when informational value matters most.
Over the past seven days, a mid-cap restaking protocol shed 40% of its liquidity providers in a single epoch, and three of the four published risk assessments covering it still list technical risk as "low โ audited." The question allocators are actually asking right now is not what will outperform. It is whether what they hold is still solvent on Thursday. An empty report answers neither question, and it costs the same as the report that would have.
Core
A schema with no null type will hallucinate
In C, dereferencing a pointer without a null check is not a mistake of intent. It is a missing invariant. The language permits it, the runtime executes it, and the fault surfaces somewhere downstream as a segmentation fault with no apparent connection to the original omission.
The nine-dimension template has the same defect. It has no representation for "we did not look."
Look at the actual schema. Every field is typed. Team technical capability accepts exactly three values: strong, moderate, weak. Token unlock risk accepts low, medium, high, critical. Regulatory exposure accepts a jurisdiction string. There is no fourth state. "Information insufficient" is not a value in the schema โ it is a placeholder that a downstream reader parses as a value. The moment it enters the pipeline it becomes indistinguishable from an assessment.
This is where the zeros come from. An analyst โ or, more commonly in 2026, a model โ is handed a contract address and told to populate forty-seven fields. For the top-ten holder concentration field, there is no clean on-chain answer, because supply is distributed across four chains and a custodial omnibus wallet. The correct answer is null. The schema has no null. So the model produces a number, the number is plausible, and the fill rate goes up.
Fill rate is the tell. Ask any research vendor what they track internally. If the answer is report completion percentage, you are not buying analysis. You are buying a rendering job. Once fill rate is the KPI, the cheapest path to a complete report is fabrication, and fabrication is indistinguishable from competence at the review layer, because the reviewer is checking whether the cells are empty.
The constructive version of this is not complicated, and almost nobody does it. Every field should carry a provenance tuple: source, retrieval method, block height or timestamp, and whether the value was observed or inferred. Unpopulated fields should render as unpopulated โ visibly, in the same typeface, with the same weight as populated ones. A report that is 90% null is a valid and useful output. It says this asset cannot be assessed, which in a bear market is actionable, because the correct position size is zero.
I have written two-line findings that mattered more than any hundred-page report I have ever produced. In 2017 I was manually auditing the 0x Protocol v2 contracts during the ICO window, executing test cases locally rather than running a scanner, because scanners only find the classes of bug they were taught. The exchange logic mutated state before an external call returned. Reentrancy. Roughly $15 million in user funds reachable. I sent it directly to the repository rather than through a pull request, and the team patched within 48 hours.
There was no row for that finding. The template had rows for governance structure, advisor pedigree, and market narrative. It would have scored 0x's token economics to four decimal places and never once asked whether the settlement path could be re-entered. The bug lived in a place the schema had no field for, which is exactly where bugs live.
The stack trace doesn't lie
Contrast that with what a claim looks like when it can be checked.
In May 2022 I spent the collapse of the Terra ecosystem doing arithmetic instead of watching charts. I traced the $18 billion to a recursive loop in Anchor's yield generation mechanism โ deposit, mint, deposit again, with the minting contract serving as both the source of the incentive and the counterparty to it. I pulled the transaction hashes. Each one is an address and a block height. Anyone can re-execute the sequence and reach the same terminal state. The conclusion is not an opinion about Terra. It is a property of the code, and the code is public.
In 2021 I spent six weeks reverse-engineering Uniswap v3's concentrated liquidity mechanics. The interesting defect was not in the swap path everyone was watching. It was a precision error in the fee accounting for extreme price ranges. Re-deriving the tick math by hand gives a persistent drag of roughly 0.04% on liquidity providers at the edges. Small. Persistent. Verifiable by anyone willing to do the arithmetic.
After FTX, I worked with on-chain forensic firms tracing $4 billion of user funds through a mesh of cross-chain bridges. The pattern that cracked it was a sequence of micro-transactions used to obscure the flow โ a signature so regular it functioned as a fingerprint. That fingerprint sits on a public ledger. The legal consequence followed from the arithmetic, not from the narrative.
Each of those findings shares one property. There is a falsifiable claim attached to an address, a line number, or a formula. You can disagree with my interpretation. You cannot disagree with the transaction.
That is the shape of the difference. A risk matrix with nine rows of "unable to assess" has no address. No line. No formula. It cannot be checked, which means it cannot be wrong, which means it cannot be right. A document that cannot be wrong is not a weak document. It is a document with zero information content, wrapped in the visual grammar of rigor: tables, star ratings, probability columns, a glossary.
The same pathology shows up wherever the market substitutes formatting for measurement. Consider the current enthusiasm for routing token state through Bitcoin's blockspace. The engineering question is narrow and entirely answerable. Inscriptions consume block space. Block space is a fixed resource priced by a fee market. Every byte a token standard occupies is a byte unavailable to monetary settlement. You can measure the displacement. You can measure the fee impact on ordinary transactions. You can measure the cost per unit of state written. None of it appears in any launch template I have been sent this year. What appears is a token distribution chart and a community-driven line item, which is the same as saying nothing while looking like you said something.
The 2026 vector: an empty report is exit liquidity
Last year I audited an AI-driven trading protocol in which autonomous agents priced and executed their own flow. The consensus mechanism was fine. The oracle data feed was not. It updated on a fixed interval, and inside that interval the price the contract believed was stale. An agent that could read the feed's cadence could front-run its own execution into the stale window for a consistent spread. I simulated 10,000 trades. The arbitrage gain held at roughly 2% with no decay โ the signature of a structural latency, not a market inefficiency.
Several institutional funds were days from deploying into it. Their due-diligence documents were complete. Every field filled. The technical risk row read low โ audited. The audit was real; it covered the code. The vulnerability was in the timing relationship between the code and an external feed, which is a field no template in the folder possessed, because in 2021 that field did not need to exist.
Templates encode yesterday's attack surface. That is their function and their limitation. The attack surface moves. A report filled entirely with fields that were correct in 2021 is more dangerous than an empty one, because it confers false confidence at the exact moment confidence is least earned.
There is a related illusion worth naming. Nearly every framework in circulation scores compliance as a green row if a project operates a KYC gate. In practice most of those gates are perimeter theater. The flow they block was never going to be the problem. The cost they impose is borne by users who were honestly trying to comply, while anyone motivated enough to route around a gate does so with a handful of wallet purchases and a bridge. Meanwhile the real question โ can this entity survive contact with a regulator โ is not in the schema, because it is not answerable from a contract address.
Contrarian
The empty report is not the failure. It is the most honest artifact in the folder.
A framework that returns forty-seven N/As has, at minimum, declined to lie. That is not nothing. Compare it to the alternative: the same asset, the same absent data, rendered as forty-seven confident values with a four-star technical score and a low risk rating at the top. The empty report tells you where the boundary of knowledge is. The confident report hides it. We punish the first and fund the second, and then we act surprised when the second one blows up.
I want to be precise about where the fault sits, because it is popular to blame the tools. The tooling is downstream. The incentive is upstream. Allocators purchase coverage. Coverage is measured by the presence of an artifact. Nothing in that loop rewards the analyst who returns a null, and everything in it rewards the analyst who returns a page. Change the schema and you have changed nothing, because the schema is downstream too.
If there is a blind spot in how this market allocates attention, it is the persistent belief that research is a substitute for regulatory standing. It is not. Post-2022, the entities that survived enforcement were not the best-researched ones. The organization whose moat demonstrably widened after the largest fine in the industry's history was the one holding licenses โ the only asset in this sector that a template cannot manufacture and a competitor cannot fork. Everyone is busy scoring narratives. The field that actually predicted survival was never in the framework.
Takeaway
So ask for the null.
When the next forty-page assessment arrives, skip to the risk matrix and count the rows that say unable to assess. Then ask the author why they filled the rest. If the answer is a methodology page, you already have your answer.
The stack trace doesn't lie. Everything that cannot show you a trace is a rendering, and a rendering can be any shape you want it to be.
What did you actually verify this week โ or did you only file the paperwork that says you did?
