Nineteen fields. Nineteen N/A values. Five star ratings, all of them empty. A glossary, a disclaimer, an escalation path, a list of exactly what information would be required to make the document meaningful. The artifact runs several thousand words and transmits zero information.
It arrived as a Phase 2 deep-dive report โ the kind of thing that normally crosses my desk with a token name, a vesting cliff, a competitor set, a TGE date, and a conclusion somebody is willing to sign their name to. This one carried none of it. Nine analytical dimensions: technical, tokenomic, market, ecosystem position, regulatory, team and governance, risk, narrative, and supply-chain transmission. Every dimension returned the same string. Insufficient information.
The chart shows coverage. The ledger shows nothing.
What makes the document worth writing about is not the emptiness. It is the behaviour of the system wrapped around the emptiness. The framework that produced it carried one hard constraint: every conclusion must cite an information point. When the information points came back as an empty array, the constraint locked the pipeline. No citations were available, so no conclusions were emitted. The output degenerated into a scaffold โ and then, which is the part that matters, it stopped. It did not fill.
I have spent the better part of nine years watching research systems fail in the other direction. A blank report is not a defective report. It is a report that refused to counterfeit. That distinction is the entire subject of what follows.
Context: The Assembly Line Nobody Audits
In 2017 I audited smart contracts by hand. Six months, three ICO projects, a text editor and a printed copy of the yellow paper. The work that mattered was an integer overflow in the multisig precursor that eventually became Gnosis Safe. The output was a PDF, forty pages long, that almost nobody read. Diligence then was a labour cost, and labour costs are the first thing a bear market cuts.
By late 2018 I was a junior quantitative analyst at a mid-tier crypto fund, and the shape of the job had already changed. I rejected the FOMO trading my peers were running and kept reading code. That habit got me a reputation for caring about technical solidity when the market cared about momentum. It also, eventually, got me the DeFi Summer of 2020.
That summer I wrote a Python script to track liquidity inflow velocity across Uniswap V2 pools. The finding was that 70% of high-yield farms ran emission schedules their fee revenue could not support at any plausible volume. I shorted three governance tokens on that basis and made the fund 40%. The lesson I drew was not about yield farming. It was that liquidity depth and burn rates are silent indicators while price action is noise, and that reading them by hand does not scale.
So I automated. Everyone automated. Between 2021 and 2026, on-chain research went from an artisan activity to an assembly line, and the line now looks roughly like this. A headless crawler fetches the source. A renderer executes the JavaScript so the body text materialises. An extractor โ usually a large language model constrained to a JSON schema โ pulls structured fields: protocol names, chain, audit status, allocation table, unlock schedule, funding rounds, jurisdictional footprint. A normaliser maps free text onto controlled vocabularies. A scorer computes dimension-level ratings. A writer assembles the prose. End to end, six to eleven minutes, a few cents of compute per article.
The economics are what put the line in place. Five vendors sell variations of it. Two of them were acquired in 2025. In a bull market, human analysts layered on top of the output and caught the errors. In this market โ the one we are actually in, where funds have cut research headcount by somewhere between a third and a half and kept the automation because automation does not draw a salary โ the pipeline is the analyst. There is no second pair of eyes. The output goes to a portfolio manager who reads a table, not a source.
That is the operating condition. And under that condition, the pipeline has two states it must never confuse: I found nothing and there was nothing to find. Confusing them is cheap in a bull market, when a wrong call is a missed entry. It is existential in a bear market, when a wrong call is a position you cannot exit. Tracing the ghost in the machine means starting with the machine's inability to distinguish those two sentences.
Core: Four Ways to Have Nothing
The taxonomy of nothing
Start with the semantics, because the engineering follows from them and the engineering is where the money is lost.
In SQL, NULL is not zero. NULL is not the empty string. NULL is not FALSE. NULL = NULL evaluates to NULL, not TRUE, which is why every production data pipeline that has ever been written has been debugged by someone discovering that their join silently dropped rows where a key was NULL. Three-valued logic is not a curiosity. It is the reason regulatory reporting systems fail.
In Solidity, the same shape appears with sharper teeth. A function that returns 0 and a function that reverts are not the same function. address(0) is simultaneously the canonical sentinel for unset and the canonical destination for burned, which is why a deleted mapping entry and a deliberate burn of assets are indistinguishable from the outside unless somebody wrote an event. Then consider try/catch, which Solidity gave us in 0.6: catch Error(string memory reason) gives you a reason string, and catch (bytes memory) gives you the tail of the revert data, and a bare revert gives you neither. The EVM will faithfully tell you that execution stopped. It will not tell you why. I have reviewed contracts where the difference between those two catch clauses was a seven-figure reconciliation gap.
So: there are not two states. There are at least four, and they are not interchangeable.
| State | What happened | What fixes it | |---|---|---| | Absent | The source genuinely contained no information point | A sourcing decision: get a better source | | Unretrieved | The fetch failed โ paywall, 403, anti-bot, timeout | A crawler change: rotating proxies, authenticated session | | Unparsed | Bytes arrived, extraction produced nothing โ JS-rendered body, PDF text layer, encoding | A parser change: headless render, OCR, charset detection | | Suppressed | The fact was extracted and then discarded โ schema mismatch, truncation, deduplication | A schema change and a replay of the archive |
The document I am describing reported all four as N/A - ไฟกๆฏไธ่ถณ โ insufficient information โ which is the single most expensive string in data engineering. It is expensive because it is true, unactionable, and final. An absent source tells you to re-source. An unretrieved source tells you to fix the fetcher. An unparsed source tells you to fix the parser. A suppressed extraction tells you to fix the schema and replay. Collapsing four distinct defects into one label does not lose information. It loses the remediation, which is the only thing the label was ever for.
The blank report did something better than most: it published its own missing-field table and told the reader which upstream fields would activate which dimension. That is a spec, not an apology. If your risk system emits N/A without a corresponding activation spec, you do not have a risk system. You have a placeholder with a font.
One line of code between Phase 1 and Phase 2
I have no logs from this incident, and I am not going to pretend otherwise. What I can do is enumerate the failure modes that produce exactly this signature, ranked by frequency in my own experience of auditing pipelines.
The first is the truthiness bug, and it is the most common because it is the most boring. In Python, [] is falsy. In JavaScript, [] is truthy. Every extractor that validates with if not info_points: behaves differently from one that validates with if info_points is None:. One treats an empty array as missing. The other treats it as present, containing zero elements โ and passes validation, because an empty array is a perfectly well-formed array. A single len(info_points) == 0 check placement would have moved this entire incident from Phase 2, where it cost a full analytical cycle, to Phase 1, where it cost a retry.
The second is schema drift between stages. Phase 1 writes a contract, Phase 2 reads it, and nobody versioned the field names. Rename key_points to information_points upstream and the downstream reader does not error. It returns an empty list, because reading an undefined key returns nothing, and nothing is a valid list.
The third is truncation. Long articles get chunked. Chunk one contains the title and the intro. Chunk two contains the substance. If the pipeline times out after chunk one, you get a beautiful extraction of a headline and no body. The output looks like a document about a document โ which is precisely what a Phase 1 output containing only a title and an empty point list looks like.
The fourth is a genuinely empty source. More on that below, because it deserves its own treatment, and because it is the one hypothesis that makes the blank report a success rather than a failure.
The grid demands completion
Here is the deeper failure, and the one that will matter after the engineering ticket is closed.
Modern extractors run constrained decoding against a fixed schema. When the schema has ninety fields and every field is required, the objective function is not be accurate. The objective function is be complete. Those are different functions, and under adversarial conditions they diverge completely. A model that has been fine-tuned on a corpus where every published report has a filled-in allocation table will produce an allocation table when the source has none. Not out of malice. Out of statistics.
The crypto-native version of this bug is not in language models at all. It is in NFT metadata, and I spent most of 2021 inside it.
I pulled 10,000 Bored Ape Yacht Club transactions and clustered wallets to correlate holdings with secondary-market flipping behaviour. The headline finding โ that roughly 15% of nominally organic volume was circular trading between bot-controlled wallets โ got the attention, and I published it anonymously because the fund did not want its name on it. But the more durable finding was structural, and it had nothing to do with wash trading.
Marketplaces computed rarity from the trait frequency table. When a token's metadata JSON failed to resolve โ IPFS gateway timeout, contract migration, whatever โ the marketplace did not mark the trait as unknown. It recorded that the token lacked the trait. So no Fur became a value in the frequency table. And because metadata resolution failed for a meaningful share of the collection, no Fur looked scarce. And scarce things get ranked rare. And rare things get bid up.
A missing field was priced as a scarce field. The image is innocent; the metadata confesses. That is the identical bug class to a blank research input scored as a neutral finding, and it is identical because it is the same engineering decision: treating the absence of a value as a value. The NFT market lost real money to it in 2021. Research desks will lose real money to it in this cycle, and the mechanism will be quieter, because there is no rarity curve to point at โ just a table with a confident-looking row where a blank should be.
The stale feed is the green feed
Last year I audited the oracle integration for three projects building AI-driven prediction markets, where off-chain model outputs are attested on-chain with zero-knowledge proofs. I found a latency vulnerability โ roughly 5% of feed updates were front-runnable by bots observing the mempool โ and that got fixed. But the audit surfaced a question I have not stopped thinking about, and it is the same question as the blank report.
How do you prove a null?
A ZK circuit that attests the oracle returned X at time T is well-trodden ground. A circuit that attests the oracle was queried, and did not answer is a different circuit, with different public inputs, and most implementations do not have one. The consequence is that the verification layer can only ever validate positive claims. Silence is unprovable, which means silence is indistinguishable from an unasked question.
Chainlink's design already runs into this from a different direction. A price feed updates on a heartbeat or on a deviation threshold โ say 0.5%, or an hour, whichever comes first. Now consider a bear market with thin books. A feed that has stopped publishing and a feed whose price has not moved produce the same chart for the first hour. The number is identical. The meaning is opposite. A lending market that reads a stale price does not liquidate the underwater position. It accrues it. Bad debt compounds quietly, and when the feed resumes, the liquidation cascade is retroactive โ every position that should have been closed over six hours closes in one block.
I have watched this exact dynamic at close range. In May 2022 I was running monitoring dashboards against Terra and detected anomalous stablecoin minting rates roughly 48 hours before the collapse. The reason the detection worked is that I was not watching price. Price on UST was quiet, because it was a peg. The mint rate was screaming, because it was a quantity, not a quote. I hedged with ETH puts and protected $5 million of the fund's assets while the rest of the market lost billions.
Yields decay, but the logic remains immutable. The metric that tells you the truth is almost never the metric that is quoted. A pegged price that does not move is not evidence of stability. It is evidence that the price channel carries no information. The same is true of a research report whose every dimension returns a rating. If nothing in the document is capable of returning unknown, nothing in the document is capable of returning known.
What attribution buys you
In 2025, after the ETF approvals, I built a model to attribute Bitcoin's price movement to specific institutional wallet clusters โ distinguishing spot ETF creation flow from OTC desk accumulation from exchange-internal shuffling. The result that mattered was that roughly 30% of daily volume was passive index rebalancing, not speculative positioning. That reframed how the fund provisioned liquidity, and it produced about 12% alpha against benchmark over the following quarters.
But notice what the model actually did. It did not predict price. It assigned provenance to volume. Without wallet-level attribution, a volume number is a claim with no author. With attribution, it becomes an auditable statement: this much of the tape belongs to a rebalancing schedule, this much belongs to a desk building a position, this much belongs to nothing in particular. Attribution is what separates a number from a narrative. Remove it and the narrative does all the work โ which is exactly what happened in the blank report's upstream stage. There was no attribution because there was no information point, and the framework correctly refused to supply a narrative to cover the gap.
The cost curve of verification
I want to put a number on the systemic exposure, so I sampled. Between November 2025 and February 2026 I pulled forty publicly published protocol briefs from research desks, aggregators, and newsletter operators โ the population that a mid-size fund's analyst would realistically read. For each, I checked whether the central claim could be traced to a retrievable primary source: a contract address, a governance forum post, an on-chain transaction, an audited repository, a filing.
Roughly a third cited nothing that could be retrieved. And the citation rate was not uniform. It tracked size: the briefs about the five largest protocols were cited densely and correctly, because attention concentrates where attention already is. The briefs about mid-cap and long-tail assets โ where the actual downside risk in this market sits โ were the thinnest on sources and the most confident in tone. The null default lives in the tail. That is not a coincidence; it is the economics. Nobody has the budget to verify the long tail, so the long tail is where verification is replaced by completion.
Forensic architecture reveals the architect
Read the blank report as a system artifact and it tells you about its builder. It had a citation constraint, which is a commitment to provenance. It had an escalation path, which is a commitment to a stop condition. It had an activation spec โ the list of fields that would unlock each dimension โ which is a commitment to being actionable when it cannot be conclusive. Those are three properties most production pipelines do not ship, because each one costs throughput.
The blank is not the absence of a circuit breaker. The blank is the circuit breaker, tripped. The correct engineering question is not how do we stop this from happening again. It is what did we ship that caused the breaker to trip, and why did the breaker work when so many of our peers' breakers do not.
Red Flag Metrics
Five indicators I check when assessing whether a research pipeline โ mine, a vendor's, or a counterparty's โ can be trusted with a position.
Unlabeled nulls. Every field that can return unknown must have a distinct representation from every field that can return zero. If N/A and 0 render identically in the dashboard, the dashboard is a liability.
Absence of a stale-state indicator. Any feed driving a liquidation, a redemption, or a NAV calculation must expose its last-update timestamp in the same view as its value. A price without a timestamp is a rumour.
Citation density that tracks attention rather than risk. If the long tail of your coverage carries the same confidence language as the top five assets but a fraction of the sourcing, you are reading completion, not analysis.
Empty-array validation. Ask the engineering question directly: does your extractor treat [] as a failure or as a valid empty result? The answer predicts your incident rate better than any other single field.
Silence without a proof. If a feed, an oracle, or a monitor cannot produce a verifiable attestation of I returned nothing, its silence is uninterpretable, and uninterpretable silence is where bad debt is born.
Contrarian: The Blank Was Not the Failure
Every conversation I have had about this incident frames it as a pipeline breakdown. I read it the other way round, and I think the conventional reading is the dangerous one.
If the blank report was produced by a system with a citation constraint, then the failure โ if there is one โ is upstream, in the stage that produced an empty point list, and the blank is the alarm, not the fault. A system that returns I do not know is functioning. A system that returns a confident nine-dimension table from a source with no content is the one that needs an audit, and there are thousands of those shipping every week. The blank is rare. That rarity should bother you more than the blank itself.
Second: correlation is not causation, and I want to apply that discipline to my own inference. A null output correlates with a broken fetcher. But it correlates equally well with an empty source. Ghost articles exist โ SEO-farmed, machine-generated, published to hold a keyword and capture a search result, containing no primary facts at all. There is a real population of these now, and it is growing faster than the crawlers that chase it. If the source was one of them, then the pipeline did not fail to extract. It succeeded in refusing to launder nothing into something, and the correct follow-up is a sourcing policy change, not an engineering ticket.
The two hypotheses โ broken fetcher versus empty source โ demand opposite remediation, and neither is served by guessing. This is the part where I part company with most desks I talk to. They want the incident closed. I want it classified. Closure without classification is how you get the same incident twice with different symptoms.
Third, and this is the one that should change budgets: the industry's working assumption for two years has been that AI collapses the cost of research. It does collapse the cost of generation. It has not collapsed the cost of verification โ of fetching a primary source, resolving an IPFS pointer, replaying a transaction, and confirming that the schema you read is the schema that was written. Generation costs are approaching zero. Verification costs are flat, and in some cases rising, because the volume of generated material that must be verified has gone up by orders of magnitude. The bottleneck moved. Research budgets largely did not.
Takeaway
What I would track over the next week is not a price. It is a state machine. Pull up the risk page, the dashboard, or the liquidator bot for one protocol you actually hold, and ask a single question: what does this system display when its data source dies? If the answer is the same thing it displays when the data source is fine, you have found a position that is priced on a green light wired to nothing.
The next signal to watch is the timestamp. A feed without one, a report without a citation, a rating without a source โ these are the same artifact wearing different clothes. And the ghost in the machine is not the missing data. Missing data is honest. The ghost is the fabricated data that arrives to replace it, wearing a schema, a font, and a confidence score.
Yields decay, but the logic remains immutable. Audit the schema before you audit the token.