Null Is Not Neutral: A Forensic Teardown of Crypto Due Diligence Built on Empty Data

Forty-Seven Fields, Zero Values

In the second week of January 2026, a diligence packet arrived in my inbox. Forty-seven fields. Nine analytical dimensions: technology stack, token economics, market structure, ecosystem position, regulatory posture, team and governance, risk matrix, narrative durability, and supply-chain transmission.

Zero populated values.

The document was impeccably formatted. Column widths were consistent. Every row carried a stable identifier. Every row carried the same string: "N/A — insufficient information." Thirty-four instances. The remaining thirteen entries were section headers.

It was not discarded. It moved one layer up the chain, into an investment committee queue, with a cover note appended by the analyst: "Structure is complete; substance pending."

That sentence is the problem. Not the missing data. The sentence. Because I have now read that same sentence in audit reports, oracle adapters, NFT metadata manifests, and Layer 2 growth dashboards for six years, and every time it preceded a loss of capital. The format was treated as evidence. The values were treated as a detail to be resolved later.

I am not going to write about the protocol inside that packet. There is nothing to write about, and inventing substance to fill a schema is the exact failure I am describing. I am going to write about the packet itself, as an artifact, because the packet is the most honest document produced in crypto research this quarter and almost nobody is reading it correctly.

Logic > Hype. ⚠️ Deep article forbidden

The Schema Economy

A schema is a promise about where answers live. It is not a promise that the answers exist.

Crypto due diligence adopted the nine-dimension framework for a defensible reason. Allocators sit on risk committees. Risk committees need comparability. If you evaluate one protocol across eleven axes and another across three, you cannot rank them, you cannot size them against each other, and you cannot write a policy around them. Standardization buys you comparability. That is real utility, and I use standardized frameworks myself.

The failure mode emerged when the cost of producing a formatted artifact fell below the cost of producing a populated one. That happened somewhere between 2023 and 2025. Template generation became free. Retrieval did not. Reading a block explorer, reproducing a supply schedule from vesting contracts, verifying that governance proposals actually executed — these remain expensive, adversarial, and slow. So the industry industrialized the cheap half and outsourced the expensive half to a blank cell.

Consolidation markets accelerate this. In the current sideways tape, the number of genuinely new protocol launches per quarter is flat to declining. Primary data is thinning. Demand for research is not. Reports beget reports. Meta-reports. Frameworks that score other frameworks. The empty nine-dimension report is not an aberration of this process. It is its logical endpoint, and it arrived exactly on schedule.

What makes the January packet worth dissecting is not that it was empty. It is that emptiness was rendered invisibly. Every dimension had a row. Every row had a header. Every header had a slot. The document satisfied its own structural contract completely while satisfying its epistemic contract not at all, and the human reading it was trained to scan structure first.

Crypto has an entire asset class built on this exact pattern. So let me take it apart in the order that matters.

Null Is Not Neutral: The Solidity Default

In Solidity, an uninitialized storage slot is zero.

That sentence contains more risk than most threat models. A uint256 that has never been assigned reads as 0. An address that has never been assigned reads as 0x0000000000000000000000000000000000000000. A mapping returns the zero value for any key that was never written. A bool that was never set reads as false, which in a permission check means "denied," but in an inverse permission check means "authorized."

The language does not have a native concept of unknown. It has zero. Absence and zero are the same byte pattern. The EVM is not being hostile; it is being deterministic, which is the correct design for a state machine and a catastrophic design for a risk system that assumes a populated field means a populated field.

During the 2020 DeFi Summer I audited the initial release of a lending protocol's core contracts while the front end advertised a $50 million TVL surge. I ran formal verification against the reentrancy guard and found three integer overflow paths in the guard logic itself. The guard's state variable initialized to a value that made the first branch evaluate as permissive, not restrictive. The contract read "never configured" and interpreted it as "configured to allow." It took three weeks of argument before the team accepted that the correct fix was not a larger variable. It was an explicit initialization and an assertion that the value could never be zero again. I refused to sign until the assertion existed.

That is the entire discipline in miniature. For every state variable in a system, you must be able to answer two questions: what does this mean before it is ever assigned, and can I distinguish "unassigned" from "assigned to the value the system treats as neutral?" If the protocol cannot answer both, it has an unmeasured attack surface, and the size of that surface is proportional to the number of variables, not to the marketing budget.

Most audits do not ask the second question. They check that assigned values are handled correctly. They do not check that the absence of assignment is handled at all, because the tooling reports zero as a value rather than as a hole. The scanner is happy. The scanner is always happy.

Now transplant that into the diligence pipeline. A framework that records "Team: N/A" and "Team: anonymous, doxxed to three people, one of whom has a verifiable GitHub history since 2016" is using the same string field for a null and for a fact. The reader processes both as populated rows. The pipeline has inherited Solidity's default semantics without inheriting Solidity's determinism.

Logic > Hype. ⚠️ Deep article forbidden

The Off-Chain Null: A 404 Wearing a Token Standard

The cleanest version of this failure I have personally handled is the 2023 NFT case.

A generative collection, floor price at 10 ETH, roughly 12,000 tokens. I was engaged to audit the contract, not the collection. The contract was fine in isolation. It implemented tokenURI() correctly. It returned a string. It was standard-compliant in every externally observable respect.

The string pointed at a centralized server. The server had been unresponsive for an unknown period. I enumerated all 12,000 token IDs and attempted metadata resolution. Twelve thousand failures. Zero successes. Time-to-first-failure was under 200 milliseconds on a warm connection, which told me the DNS resolution was failing rather than the origin — meaning this had been dead for a while, not since that afternoon.

Here is the part that is worth more than the finding itself. Several RPC endpoints and marketplace indexers were serving a cached response from eleven days earlier. During those eleven days, secondary markets continued to price the collection against metadata that no longer resolved anywhere on the network. Buyers were bidding on a receipt for a pointer to a 404. I reported it to the platform's compliance team; the collection was delisted.

The generalizable flaw is not the dead server. It is that ERC-721 specifies the shape of the answer and never specifies the availability of the referent. A token standard that guarantees tokenURI() returns a string has guaranteed nothing about whether that string means anything. The asset can be structurally valid and semantically empty, and there is no revert, no event, no failed transaction. The chain records a successful call.

Now return to the diligence packet. Nine dimensions, thirty-four "N/A" rows. Every one of those rows is a resolved pointer to nothing. The document did not fail. It returned successfully. That is precisely why it survived transmission into an investment committee, and why the 12,000 token holders kept seeing a green candle.

Oracle Absence Read as Zero: The 2026 Agent Case

In 2026 I analyzed an autonomous trading agent that executed transactions on-chain without a human in the loop. It managed over $20 million in user funds. The machine learning layer was unremarkable: a policy function mapping observable state to actions, wrapped in a contract that held the collateral.

The vulnerability was in the adapter between the oracle and the policy.

When the price feed was healthy, the adapter returned the price. When the feed was stale beyond its heartbeat window, or when the feed's own source reverted, the adapter's fallback path returned 0. Not a revert. Not a sentinel. Zero.

The policy function had no representation for "unknown." It had a representation for "price." So it processed 0 as "price is zero," which routed into the liquidation branch, which was a legitimate branch, which executed correctly. Every component behaved as specified. The composition was fatal.

Exploitation is not exotic. You wait for the heartbeat window, you force staleness — a flash loan against the source pool is sufficient in several configurations — and you hold the branch for the duration of a block. The agent will do the rest, autonomously, without hesitation, exactly as designed.

I published a case study on the intersection of policy logic and blockchain immutability. It is now cited in two draft regulatory frameworks on agentic finance, most likely because the finding is easy to state and hard to argue with: a system incapable of representing "I do not know" will represent "I do not know" as a decision.

The remediation was not a better model. It was a sentinel value and a hard revert. Twelve lines of code. The project had spent four months tuning inference parameters before that.

The same structure is sitting in the diligence packet. A framework with no representable state for "we could not retrieve this" will render the unretrievable as a row, and a row is a decision input. The only difference between the oracle adapter and the analyst is that the analyst had a vocabulary for uncertainty and still chose the string "N/A" instead of halting the pipeline. The adapter had no vocabulary at all. The analyst had one and used it as a value.

Logic > Hype. ⚠️ Deep article forbidden

Metrics That Cannot Be Empty Because Someone Always Fills Them

There is a second class of null, and it is more dangerous than the first. In this class, the field cannot go empty, because the workflow requires a number. So a number is produced.

Take total value locked across Layer 2 networks. The most common methodology sums the TVL reported by each rollup. A dollar bridged from Ethereum into Rollup A and then into Rollup B is counted twice. Route it through a liquidity aggregator that itself reports a TVL figure and it may be counted three times. Nobody in that pipeline is lying. Each reporter is answering a well-defined question about their own contract state. The schema said "TVL: number." The schema got a number.

I have run this reconciliation by hand on a mid-size sample of bridges. The summed reported figure and the unique depositor-equivalent figure diverged by a factor I will not state precisely, because the methodology is the point and the specific multiplier depends entirely on which bridges you include. What is stable across every sample I have taken is the direction: summed reported TVL always exceeds unique-capital TVL, and the gap widens as the number of intermediate hops increases.

Active addresses behave identically. A DAU figure without deduplication across chains and without a definition of "active" that excludes incentivized dust transactions is not a metric. It is a count of API responses. Volume without wash filtering is the same object with a different label. Staking totals without a net-new-capital adjustment are a measure of internal rotation.

Then there is the Layer 2 structural problem, which is a null problem wearing different clothes. There are dozens of rollups. There is one small cohort of users and one pool of capital. When a new rollup launches with an incentive program, its TVL is not created; it is transferred, minus bridge friction, from an incumbent. The incumbent's dashboard records a decline. The new one records a surge. The sum is roughly unchanged, and both dashboards publish. This is not scaling. It is slicing an already-scarce liquidity pool into more fragments, and then reporting each fragment as if it were the pool.

A fragmented pool in a consolidation market has a specific mechanical cost: slippage. More venues holding less depth each means every marginal dollar trades worse. That is a real, measurable, negative-sum outcome, and it does not appear anywhere in the nine-dimension framework, because the framework has a row for "market structure" and the row was filled with a dashboard screenshot.

Which brings me back to the January packet. Thirty-four N/A rows. Compared with a dashboard that reports six-figure active users derived from a query that counts a wallet four times for interacting with four contracts, the N/A rows are the more truthful artifact. At least the empty report did not manufacture a number to satisfy a schema. It manufactured a shape.

An Empty Field Is a Datum

This is where the packet stops being an embarrassment and starts being evidence.

An empty field is not the absence of information. It is information of a specific and useful kind, and it decomposes into four separable readings that most analysts collapse into one.

First, the schema is a hypothesis. Whoever designed the framework wrote down what they believe must exist for a protocol to be evaluable: a technology section, a supply schedule, a governance model, a risk matrix. When all thirty-four rows return nothing, you have learned that the project has no retrievable instantiation of any of the categories the framework's author considers load-bearing. That is not a data gap. That is a finding about the project's observable surface area.

Second, you must separate "not provided" from "not applicable," and the packet conflated them. These are different claims. "Not provided" describes a pipeline failure — the data exists somewhere and did not reach the analyst, which means the analyst's retrieval process, not the project, is the broken component. "Not applicable" describes the world — the category does not apply to this protocol, which the framework's author must then justify. The January packet used identical strings for both. Thirty-four rows, one vocabulary, two incompatible meanings. A reader cannot tell whether the protocol has no vesting schedule or whether nobody opened the vesting contract. Those two situations have opposite risk profiles and the document renders them identically.

Third, an empty field is a cheap attack-surface map. If a diligence framework with an incentive to populate it cannot populate row twelve, a counterparty with no incentive cannot populate row twelve either. Every field that survived the retrieval attempt is a field where the project's own disclosures are strong enough to be found. Every field that did not is a field where the only available narrative is the one the project itself produced. That asymmetry tells you where the project's information advantage is concentrated, and information advantage concentrated in a single actor is a control risk, not a disclosure gap.

Fourth, and this is the operational one: the reproduction test. Take any protocol's own diligence material. Select ten quantitative claims. Attempt to reproduce each from primary sources — contract state, block explorer, governance execution logs, vesting contract balances — within thirty minutes per claim. If you are a competent analyst and you cannot reproduce a majority of them, you are not reading a report. You are reading a schema that has been rendered without being filled, and the confidence you feel is coming from the typography. I have run this test on submissions across the last three years. The failure rate is high enough that I now run it before I read anything else, because the result determines whether reading the rest is worth the time.

The Cost of a Confident Format

The arithmetic here is not complicated. A decision made against a schema with n populated fields carries posterior equal to prior on every unpopulated dimension. With zero of forty-seven populated, your posterior equals your prior on all nine dimensions, and you are making an unhedged bet while holding a document that looks like an analysis.

The danger is not the blank. It is the alignment of the columns around the blank.

I have watched a risk committee approve a position because the risk matrix was "complete." Six categories, six cells filled. Five of the six contained restatements of a single underlying fact — the same partnership announcement, rephrased as "market risk," "operational risk," "narrative risk," "competitive risk," and "ecosystem risk." The committee did not count distinct facts. It counted filled cells. The matrix had one degree of freedom and the approval treated it as six.

That is the same bug. Uninitialized reads as initialized. A repeated fact reads as six facts. A formatted document reads as a completed review. Every layer of the stack has a null-propagation flaw and every layer keeps returning success.

What the Bulls Got Right

The reflexive critique of the January packet is that it proves research is broken and frameworks are theater. That critique is lazy, and it is wrong in a way that costs money.

The correct reading is narrower. The empty report was the most honest document in that diligence process. Every other artifact in a typical submission — the growth chart, the community metrics, the TVL screenshot, the partnership slide — is a populated field, and populated fields are where the manufactured numbers live. The N/A rows were the only entries that declined to overstate. A framework that outputs thirty-four explicit refusals is doing something the alternative never does: it is refusing.

There is also a real structural defense of schemas, and it is stronger than the skeptics admit. Without a fixed framework you cannot compare two protocols, you cannot version your own historical judgments, and you cannot audit your allocators for consistency. I have built frameworks. I use them. The 2022 Anchor Protocol post-mortem that I published as forty-five pages of chain data — the yield-versus-asset-depreciation model that eventually informed two regulatory inquiries into algorithmic stablecoins — was only legible because it was organized against a fixed set of categories. The framework was the delivery mechanism. It was not the finding.

The real failure was transmission, not generation. Somebody produced a formatted artifact and somebody else moved it into a decision channel without reading the values. That is a process with no assertion in it. And the industry's current obsession is misplaced: everyone is worried about models generating plausible falsehoods, while the more immediate risk is a model correctly refusing to answer and a human routing the refusal onward as though it were a response.

The fix is not to abandon templates. It is to make unpopulated a first-class, non-renderable state. A blank cell must halt the pipeline, not decorate it. A "not provided" must be blocking. A "not applicable" must require a written justification from a named person. If a framework cannot distinguish a hole from a zero, the framework is a liability regardless of who wrote it.

Who Signs It

By 2027, agentic pipelines will generate diligence at a volume no human review process can absorb. The report will be free. The populated field will be free. The value of a formatted document will converge to zero, and the only scarce object in the entire stack will be a name attached to a verification that actually happened.

So the question is not who generated the report. The question is who signed it, what they reproduced from primary sources, and what they are willing to lose when the field they never checked turns out to have been zero the whole time.

Ask for the signature. Read the values, not the columns. And when a document tells you thirty-four times that it does not know — believe it.