The most honest document I read this quarter was a table. Nine rows. Every cell said N/A.
It arrived labeled as a second-stage analysis. Technical. Tokenomics. Market structure. Ecosystem position. Regulatory exposure. Team and governance. Risk matrix. Narrative. Contagion. Every heading was present. Every conclusion was a placeholder. The framework had been fed nothing โ no title, no source, no project, no information points โ and it had done the only defensible thing a framework can do under those conditions.
It refused.
I have audited contracts that lied. I have audited contracts that were so confidently wrong that the wrongness looked like design. I have never audited a contract that said "I don't know." That is a distinction worth sitting with, because the rest of this industry has spent five years building precisely the opposite machine: a machine that accepts an empty input and returns a confident output, with a rating and a price target stapled to the cover.
The N/A table is not the failure. The N/A table is the control group. Everything else is the experiment.
The research-industrial complex does not need a subject
Here is the shape of the problem. Crypto research is not a scientific discipline with a publishing norm. It is a marketing function with a bibliography. The outputs look like institutional coverage โ cover page, sector map, comparable-company table, risk section, disclaimer โ and the visual grammar does an enormous amount of work. A PDF with a proper header and a twelve-page appendix reads as diligence. Nobody asks whether the appendix was generated or observed.
In 2018 I audited the token sale contract of a project I will call Aether. It was a standard 2017-era crowdsale: a fallback function, a state machine, a treasury address with a single owner. The reentrancy path was trivial โ the sale credited balances before it updated the contribution mapping, and the fallback re-entered through a second contract. Forty ETH left the treasury before anyone noticed. I wrote the exploit path up on GitHub with line numbers and a reproducible test harness. The founders never responded. The report that later circulated to investors described the contract as "battle-tested" and "audited by a top-tier firm." Both statements were technically true in the sense that a firm had been paid and a document existed.
The gap between "a document exists" and "someone read the code" is the entire subject of this article. The industry's research layer has industrialized the production of documents that were never meant to be read by their authors.
What empty-input analysis actually looks like from the inside
I want to be precise about the mechanism, because "bad research" is a useless accusation. Bad research is a category. Empty-input research is a process, and the process leaves fingerprints.
The scaffold is always the same. A sector map is drawn first โ usually a two-by-two or a value-chain diagram โ because the diagram establishes that the analyst understands the landscape, and the landscape does not require the project to exist. Then a TAM estimate, sourced to a paid database that the issuer's own marketing deck also cites. Then a technology section that paraphrases the white paper's claims back at the reader without a single independent verification step: no testnet transaction, no bytecode check, no read of the deployed contract, no comparison between the whitepaper's stated mechanism and the actual constructor arguments. Then a team section built from public profiles. Then a risk section.
The risk section is the tell. If the risk section could be pasted into another project's report without a single edit, the analyst never touched the project. Generic risk in crypto is a solved problem โ regulatory uncertainty, market volatility, smart contract risk, execution risk, competition. Every report contains those five. None of them are risk. They are the absence of risk analysis wearing risk analysis as a costume.
Real risk is specific and it is boring. Real risk is: the upgrade authority is a 3-of-5 multisig whose signers are all employed by the same foundation, and the timelock is 48 hours, which is shorter than the time it takes the community to notice a malicious proposal, let alone organize against one. Real risk is: the oracle heartbeat is 24 hours with a 0.5% deviation threshold, which means in a fast market the protocol prices collateral against a number that is stale by hours. Real risk is: the token's unlock schedule front-loads 14% to private rounds at a 30-day cliff, and the vesting contract has an owner-only function that can accelerate it. That last one is not hypothetical. I have seen it four times.
None of that appears in empty-input research, because none of it can be observed without opening the chain.
The confidence score is the vulnerability
Here is the part that took me longer to understand than it should have.
Research reports publish ratings. Buy, accumulate, hold, reduce. Some publish conviction levels. Almost none publish a calibration record. That is the structural defect. A rating is a probability claim about future returns, and a probability claim without a track record is not a forecast โ it is an assertion of authority. An uncalibrated confidence score is a signature forgery executed on someone else's risk tolerance.
The report says "high conviction." The reader's brain converts that into a position size. The analyst's actual basis for "high conviction" may be a weighted score where the technology weight is 30%, the team weight is 25%, the market weight is 25%, the tokenomics weight is 20%, and none of the weights were ever disclosed, stress-tested, or back-tested. It is a number that was tuned until the output matched the conclusion the analyst already had.
I have skin in this specific game. In 2020, during the DeFi Summer, I spent the better part of three weeks forking Compound locally and hammering the interest rate model with adversarial inputs. I found a rounding behavior in the borrow rate accrual that, under a specific sequence of high-volatility borrows and repayments within a single block, could drift the exchange rate in a direction that made the protocol marginally insolvent before the next accrual corrected it. The core developers acknowledged it. They also had a liquidity mining program to ship. The fix was not prioritized. I do not think they were reckless. I think the incentive structure made a marginal solvency edge case less valuable than a TVL chart, and the incentive structure won, because it always wins when the cost of the bug is probabilistic and the cost of the delay is certain.
That is the same trade-off that governs research. The cost of a rigorous report is time. The cost of a wrong report is diffuse and deferred. The benefit of a fast report is a client relationship that renews. Under that payoff matrix, empty-input research is not a moral failure. It is the equilibrium.
Anatomy of a blank template becoming a Buy
Let me walk the conversion, step by step, because the conversion is where the damage happens and it happens in a fixed order.
Step one: the mandate. An issuer engages a research desk. Sometimes cash changes hands. Sometimes it is a listing-adjacent arrangement โ the desk gets early allocation, or market-making flow, or a data partnership. Sometimes it is pure relationship capital: the desk covers the asset because the asset's backers will later route deal flow. None of these are necessarily corrupt. All of them are structurally incompatible with independent coverage, and none of them are disclosed in the report's methodology section, which is usually three sentences long.
Step two: the sourcing. The analyst assembles public material โ white paper, blog posts, the issuer's own metrics dashboard, a database subscription. Note what is missing: the deployed bytecode, the governance forum's dissent threads, the on-chain treasury flows, the actual gas consumption of the protocol's core operations, the failure modes observed in the testnet phase. The analyst is not lying about the project. The analyst is describing the project's self-description and calling it analysis.
Step three: the scoring. A rubric converts qualitative judgments into numbers. Technology 8/10. Team 9/10. Tokenomics 6/10. Weighted average, 7.6/10, verdict: accumulate. The rubric is the laundering layer. It makes a preference look like a measurement. And because the inputs to the rubric were never observed โ only read โ the output inherits the reliability of a press release while wearing the formatting of a quantitative model.
Step four: the risk section. Five generic risks. A disclaimer that says the report is not investment advice and the author may hold positions. The disclaimer is the most honest part of the document and it is also the part nobody reads, because it is at the bottom in 8-point type and the rating is at the top in 36-point type.
Step five: distribution. The report is summarized into a thread. The thread contains the rating and the chart. The chart is a price chart. The methodology, the rubric, the weights, the sourcing โ none of it survives the compression. By the time the analysis reaches the market, it has been reduced to a number that was never defensible and a chart that was never causal.
This is not a hypothetical pipeline. I have watched it run. In 2021 I analyzed a mint contract for a collection I will call MetaBeast and found that the owner role had no access control on the pause and mint functions โ any address holding the role could halt minting or mint to arbitrary supply, and the role had been left on an EOA with no multisig. I wrote it up. Early buyers were warned. The project launched anyway. Two weeks later the floor was zero and roughly two million dollars of value had evaporated. The coverage that preceded that launch described the team as experienced and the contract as standard.
Standard. That word does a lot of work. It means "I did not check."
MiCA built a disclosure regime and got a document regime
Europe's Markets in Crypto-Assets regulation is the most consequential structural change in this industry in a decade, and I say that as someone who thinks its stablecoin reserve provisions will kill more small issuers than they save. But the part relevant here is the white paper obligation.
MiCA requires issuers of crypto-assets to publish a white paper with prescribed contents: a description of the issuer, the project, the technology, the rights and obligations attached to the asset, the risks, the consensus mechanism where applicable, and the environmental impact. There is a notification regime. There is a civil liability provision โ Article 15 โ under which information in the white paper that is misleading or incomplete can ground liability. On paper, this is a real constraint.
In practice, it created a market for white papers.
I do not mean that cynically. I mean it literally. The regulation created demand for a document type, and the market supplied a document type. Drafting shops emerged. Templates circulated. The prescribed contents are, by design, a checklist, and checklists are satisfiable without verification. An issuer can truthfully write that their consensus mechanism is proof-of-stake, that the token has a fixed supply of one billion, and that the treasury is controlled by a multisig โ and every one of those statements can be accurate while the underlying system is a single sequencer operated by the founding team with an upgrade key held by the CEO.
The disclosure regime answers the question "did you say something about X?" It does not answer the question "is what you said about X true in the deployed system?" Those are different questions. The gap between them is where retail money lives.
And the CASP side is worse. Authorization under MiCA imposes capital, governance, and custody requirements on exchanges and custodians, and those requirements have real fixed costs. The compliance burden scales with legal entity count, not with revenue. The predictable outcome is consolidation: a small number of well-capitalized venues, a long tail of projects that cannot get listed anywhere compliant, and a research layer that covers the consolidated venues because that is where the audience and the flow are. Regulatory clarity does not automatically produce better research. It produces better-documented research, which is a different product, and the market routinely confuses the two.
The gas fee test
I don't trust the audit; I trust the gas fees.
That is not a slogan, it is a methodology, and it is cheap to run. A protocol's on-chain cost structure is a fingerprint. It tells you whether the system was designed for the operations it claims to perform or whether it was designed for a demo. If a protocol claims to settle thousands of microtransactions per second and the median transaction on its chain costs more than the transaction's notional value, the claim is dead regardless of what the benchmark says. If a lending market claims to support a long tail of collateral assets and the liquidation path requires three separate transactions at peak gas, the liquidation mechanism is a subsidy for keepers during calm markets and an insolvency engine during volatility.
I have never read an empty-input research report that mentioned gas. Not once. Because gas requires execution, and execution requires a wallet, and a wallet requires the analyst to have actually used the thing.
This is the test I apply to every report I am handed. I call it the three-touch rule. First touch: does the report contain at least one number that could only have come from reading the deployed contract or the chain โ a timelock duration, a multisig threshold, an unlock cliff date, a reserve ratio computed from actual balances? Second touch: does the report describe a failure mode that is specific to this protocol's architecture and would not apply to a competitor? Third touch: does the risk section name something the issuer would prefer not to be named?
Three yeses: someone did work. Two: someone did some work. One or zero: the document is a formatting exercise, and the rating attached to it is a coin flip with better typography.
The test is crude and it is not sufficient. It is, however, sufficient to catch the majority of what circulates, which tells you something uncomfortable about the majority of what circulates.
The 2022 post-mortem and the reproducibility problem
After Terra collapsed, I did what a lot of people did and a few people finished: I sat down with the mechanism and tried to write out, line by line, why the algorithmic backstop could not have held. The answer was not complicated and it was not a surprise. The peg defense relied on a seigniorage loop that converted a fixed-supply asset into a variable-supply asset at a rate that accelerated precisely when confidence fell, which meant the defense mechanism was a function of the attack. The oracle inputs that fed the loop were themselves sourced from venues where the loop's own activity was setting the price. The system was a mirror pointing at a mirror.
What struck me afterward was not the mechanism. It was that dozens of research reports had covered the asset before the collapse, and essentially none of them had modeled the loop under stress. They had described the loop. Description and modeling are different activities. One produces a paragraph, the other produces a failure boundary.
The reason the empty-input framework is the most trustworthy artifact in this industry is that its failure is reproducible. You can hand it a blank input and it returns N/A every time, identically, on any machine. You can hand a confident research report to two analysts and get two different explanations of how the rating was derived, because the derivation was never recorded.
Reproducibility is the whole ballgame. An audit is valuable not because the auditor is smart but because the auditor's finding can be independently re-executed: here is the contract, here is the state, here is the transaction, here is the outcome. Every real vulnerability I have ever reported has that property. Every finding I have ever retracted failed it.
Research has no such property. The report gives you a conclusion and withholds the derivation. You cannot re-execute it. You cannot falsify it. You can only trust it, which means it is not research, it is testimony โ and testimony from an interested party is worth exactly what the interest is worth.
What the bulls get right
I am going to argue against my own position for a paragraph, because the position is stronger if it survives the argument.
The bulls are right about one thing: the demand for coverage is real and it is not a conspiracy. A retail participant in an emerging asset class has no realistic path to reading bytecode. A small allocator at a fund with two analysts covering forty assets cannot build a local fork of every protocol in the portfolio. Coverage is a public good. The existence of a research layer that summarizes, contextualizes, and ranks is a genuine improvement over a market where the only available signal is the issuer's own marketing.
And the second thing they get right: the cost of rigor is real. The reason empty-input research exists is not that analysts are lazy. It is that a genuine technical review of a mid-cap protocol โ reading the contracts, reproducing the build, mapping the governance surface, stress-testing the incentive model โ is a two-to-six week engagement. If the market will not pay for six weeks, the market gets the document that fits in the budget. That is not a moral failure, it is a pricing failure, and pricing failures are not fixed by shaming the supplier.
Where the bulls are wrong is the inference. From "coverage is a public good" they infer "therefore the coverage we have is adequate." It is not. From "rigor is expensive" they infer "therefore cheap coverage is a reasonable substitute." It is not a substitute. A cheap report is not a partial report. It is a different product that happens to share a cover page with the real one, and the market cannot tell them apart, which is the entire problem.
There is a version of this industry where the research layer is paid for by the people who consume it rather than the people who are covered. That version exists in equity markets and it is imperfect but it works, because the buy-side pays for the sell-side's access and the conflicts are at least disclosed as conflicts. Crypto skipped that step. The issuer pays, the desk covers, the reader trusts, and nobody in the chain has an incentive to check.
The audit-standard question nobody is asking
In 2025 I led a review of a cold storage implementation for an institutional client preparing a fund structure. The multi-signature wallet had a signing routine whose execution path varied measurably depending on key material, and the variance was sufficient to construct a timing side channel against the private key. It was not a dramatic bug. It was the kind of bug that survives because nobody benchmarks the signing path โ it works, it is fast, it passes the functional tests.
I demanded a rewrite. It cost the client roughly half a million dollars in delay and re-certification. It also closed a channel that, under the right conditions, was a nine-figure exposure. I was not popular for about three weeks.
I mention this because it is the same structural question as the research problem, just with a different surface. The industry's failure mode is not that it cannot detect problems. It is that the detection is priced against a schedule, and the schedule always wins. The signing routine shipped on time. It would have shipped on time with the side channel intact, because the side channel was not on the checklist and the checklist is what the timeline is built around.
Research has a checklist too. It is called the report template. Nine sections, every heading present, every conclusion N/A or confident, and the confidence is never the part that gets audited.
What an honest research artifact looks like
I will be concrete, because criticism without a specification is just noise.
An honest report names its inputs and distinguishes them by provenance. Not "the project's technology is mature" but "the project's technology is described as mature in the issuer's documentation; I did not verify the claim; here is what I would need to verify it and why I did not." That last clause is the entire discipline. Stating your verification boundary converts an assertion into a measurement of your own uncertainty, and a measurement of uncertainty is falsifiable.
An honest report publishes its failure modes before its upside. Not as a compliance section, but as the primary content: here is the specific sequence of events that breaks this system, here is the parameter that determines whether the break is recoverable, here is the monitoring signal that would give early warning. That is what I did with the Terra mechanism after the fact, and it is what should have been done before.
An honest report publishes a calibration record. Not a rating โ a record. What did this desk rate last year, what happened, and what is the hit rate conditional on conviction level? If the answer is that no such record exists, the reader should treat every rating as a random draw from a distribution with unknown mean, which is roughly what it is.
And an honest report costs money and says so. The conflict disclosure should be specific: who paid, how much, in what form, and what the desk's exposure to the asset is. "The author may hold positions" is not a disclosure. It is a shrug with legal formatting.
The takeaway
The code does not lie; only the founders do. I have believed that for eight years and it has never failed me, but I have to amend it. The code does not lie, and the research about the code lies constantly, and the two facts coexist comfortably because almost nobody reads both.
We are in a sideways market now, which means the research flow is down, which means the desks are hungry, which means the coverage is getting cheaper and faster and more confident. Over the past seven days I have read three reports on protocols I have actually audited. Two of them described mechanisms that do not exist in the deployed contracts. One of them listed a governance structure that was replaced fourteen months ago. All three carried a rating.
So here is the question I would put to every desk that publishes: if I handed you a blank document and asked you to produce a report, how many of your nine sections would change?
If the answer is fewer than nine, you were never analyzing the project. You were analyzing the template. And the template has been telling you what to write since 2017.
The N/A table refused. It is the only thing in this industry that has ever refused, and it did so because someone built it with the one feature nobody wants to pay for: the ability to say nothing when there is nothing to say.
Build that into your research stack. It will cost you more than the half-million-dollar rewrite. It will be worth more.