The Empty Array Is the Attack Surface: Anatomy of a Silent Failure in Crypto Research Pipelines

Last month a research pipeline produced a nine-dimension due-diligence report on a token that did not exist. Every section was populated. Every cell was empty. The technical architecture table read "N/A — insufficient information." The tokenomics unlock schedule read the same. The six-row risk matrix read the same in all six rows. The document ran to several thousand words and contained zero facts.

What stopped it from reaching a client was not a better model. It was a five-line guard at the top of the pipeline that checked whether the extracted information-point array contained at least one element. The array was empty. The guard fired. The output was rejected and returned upstream as an input-validation failure.

I have spent most of the last decade reading code that was supposed to fail safely and did not. The most expensive bugs I have found were never the ones that crashed. They were the ones that returned success.

Context

The pipeline in question is not exotic. It is the same architecture running behind a dozen "AI research copilot" products currently marketed to allocators: a scraper, a readability extractor, a language-model claim extractor, a structured JSON handoff, a scoring layer that evaluates an asset across fixed dimensions, and a synthesis layer that turns the scores into prose. Each stage holds an implicit contract with the next. Almost none of those contracts are enforced.

The commercial logic pushing these systems toward fabrication is straightforward. A research tool that returns "cannot analyze" has a churn problem. A research tool that returns a nine-section report — even one stitched together from nothing — has a retention curve. The incentive gradient points away from the guard and toward the shell. I have now reviewed four of these systems on behalf of two allocators since 2024, and the pattern is consistent: the schema is validated, the semantics are not.

What makes this worth writing about now is the bear market, not the bull one. In 2021 nobody read the reports; capital was deploying faster than diligence could clear. In the current regime, allocators are running the same tools with far less capital and far higher consequence per decision. A fabricated report in 2021 cost a mispriced position. A fabricated report in 2026 costs a treasury that was supposed to be the last one standing.

There is a second layer here that most operators miss. The pipeline did not fail because the model hallucinated. It failed because a stage upstream of the model handed it an empty array and reported success. The model, given zero facts and instructed to produce nine sections, did the only thing a well-behaved completion engine can do: it produced nine sections. The hallucination was downstream of the defect, not identical to it.

Core

The technical anatomy is worth laying out precisely, because the failure class recurs everywhere in this industry and almost nobody instruments for it.

The handoff between extraction and scoring is a JSON document. Its schema declares information_points as an array of objects. An empty array is schema-valid. A schema validator that checks types and required keys will return green on "information_points": [] — the field exists, the type is correct, the object is well-formed. The document is valid. It is also worthless. Every research pipeline I have inspected in the last two years validates shape and skips cardinality. In Solidity terms, these systems ship without require(inputs.length > 0).

That is not a metaphor. During the 2020 DeFi Summer I refactored the Solidity core of a yield aggregator and cut gas by 40%, and the largest single win was not storage packing — it was deleting redundant zero-checks the compiler already inserted. But the guards that mattered stayed in place, and they were the ones checking for non-empty inputs, non-zero addresses, and initialized state. Every auditor writes those guards because we have all seen what happens when someone does not. The people building research pipelines have never had an auditor, and it shows.

The failure modes upstream of that handoff are a familiar taxonomy:

• HTTP 200 with an empty body. Soft 404s, paywall interstitials, and bot-detection challenge pages all return success codes. The scraper does not distinguish "fetched a page" from "fetched a page containing the article."
• Field-name drift. The extractor emits informationPoints; the scorer reads information_points. In JavaScript, the missing key evaluates to undefined, and a defensive || [] in the consuming code silently coerces it into an empty array. A typo becomes a valid document.
• Swallowed exceptions. A try/catch around the extraction call returns {points: []} on failure instead of propagating. Someone added that catch to stop the pipeline from paging them at 3 a.m. They succeeded.
• Retry against a cached error. The second attempt hits a CDN edge that cached the challenge page from the first attempt, returns 200, and the pipeline logs a recovery.

Four distinct root causes, one identical downstream signature: an empty array and a green status.

This is the same class of defect I found in a major NFT marketplace's proxy contract in 2021, hours before a high-volume drop. The reentrancy itself was textbook. What made it dangerous was that the marketplace's monitoring dashboard was showing green the entire time — it monitored uptime and request latency, not state invariants. The system was healthy and the system was wrong. Monitoring the wrong layer is indistinguishable from not monitoring at all, and every research pipeline I have reviewed monitors throughput, not content density.

Which brings me to the part I have not seen anyone else implement, and the one piece of original methodology I would put in front of any allocator running these tools: the distribution of missingness is itself signal.

A legitimate analysis built on genuinely thin data has an asymmetric N/A profile. You can answer market questions from a price feed and a market-cap series even when you have no team information, no token distribution table, and no audit. You can score regulatory exposure from a jurisdiction and a sale structure even without a GitHub repository. Thin data produces partial coverage, and the shape of that partial coverage tells you what the pipeline actually retrieved.

Uniform N/A across all nine dimensions does not look like thin data. It looks like zero data. A report where the technical layer, the token layer, the market layer, the ecosystem layer, the regulatory layer, the team layer, the risk layer, the narrative layer, and the transmission layer are all blank is not a conservative assessment of a mysterious project. It is a mathematical impossibility as an assessment of any real project, because a real project with a live token has a price, and a price is a market datum.

That asymmetry is a free detection heuristic. One line of code: if the ratio of populated dimensions to total dimensions is zero, reject before synthesis. It costs nothing. It catches the exact failure the pipeline in question caught — and it catches it one stage earlier, before the model is ever asked to write prose around an absence.

The cost asymmetry justifies the gate completely. A false rejection — refusing to analyze a source that was actually adequate — costs a retry and a few cents of compute. A false acceptance costs whatever capital the reader deploys against a document that reads like diligence and contains none. These are not symmetric errors and should never be priced as if they were. Yet every pipeline I have reviewed optimizes for the false rejection, because the false rejection is the one that generates a support ticket.

Contrarian

The industry is solving the wrong problem, and the wrong problem is the more comfortable one to solve.

The current discourse frames fabrication as a model-alignment failure: better weights, better RLHF, better refusal behavior, better grounding. That framing is commercially convenient because it implies the fix ships in the next model version and the customer does nothing. I don't buy the claims of impenetrable security that vendors attach to their own guardrails, and I don't buy them here either. The highest-severity failures I have found in production data systems were never model failures. They were contract failures between stages — an unenforced precondition, a swallowed exception, a field name that drifted. No amount of model quality repairs a try/catch that returns an empty array instead of throwing.

There is a deeper blind spot underneath that one. A pipeline that fails loudly — an error page, a stack trace, a red status — gets fixed within a day. A pipeline that fails silently and produces a fully populated document with empty cells survives review indefinitely, because it passes every human check that looks at form rather than content. The nine-section skeleton is the camouflage. Completeness of format is read as rigor by every reviewer who is skimming, and skimming is the modal review behavior in this market.

And this pattern is not confined to research tooling. Look at governance. A DAO proposal that clears quorum with three voters out of a thousand token holders is the same defect wearing a different costume: empty input, valid execution, green status. The proposal passed. The schema was satisfied. The signal was zero. I have watched treasuries authorize eight-figure expenditures on votes that would have failed a cardinality check.

Takeaway

The vulnerability forecast is not subtle. Autonomous treasury agents are already being wired to research feeds, and the first documented case of an agent executing a material position on a fabricated report is a matter of time, not probability — because the agent does not skim, does not hesitate, and does not notice that every cell was empty. The mitigation is not a better model. It is input provenance attestation: signed source manifests, cardinality gates at every stage boundary, and missingness-distribution checks treated as a first-class invariant rather than a formatting detail.

The gate that stopped this report was five lines of code. That is the entire security budget required.

So the question for anyone running one of these pipelines is not whether your model hallucinates. It is narrower and harder: when your extractor returns nothing, does your system say so — or does it hand the model an empty array and ask it to be helpful?