The PDF landed in my inbox at 2:14 a.m. — sent by a founder who wanted me to bless his token before a listing. Nine sections. Forty-one tables. Just over three thousand words of immaculately formatted analysis. And in nearly every cell, the same three characters: N/A. Not applicable. Not available. Beneath each one, a bracketed refrain — insufficient information to evaluate — repeated like a liturgical response. At the close of every section, a confidence rating. Almost all of them read: High.
That is the line I cannot shake. Somebody built a machine that measured nothing, and then graded its own certainty about nothing as high. The document was internally consistent, structurally impeccable, and completely vacant. Within the hour, it would be forwarded to investors under the heading due diligence.
I have read hundreds of these. I wrote a few myself, early on, and I still feel the sting of it. So let me say plainly what an empty report is: it is not the absence of a finding. It is a finding, disguised as the absence of one.
Eighty percent of a crypto audit is knowing which fields someone wants left blank.
The Seventeen-Year-Old Who Read the Cliff
In 2017, at eighteen, I spent three months auditing fifteen early-stage ICO whitepapers during the peak of the boom. Four of them had governance flaws severe enough that I stopped sleeping well. One — I called it EtherCrowd Alpha in my write-up — distributed tokens to insiders on a thirty-day cliff while public buyers waited eighteen months. It was all there, page nine, in a vesting table nobody had bothered to photograph.
I published a bilingual series called Decentralization is Not a Buzzword, and it reached fifty thousand readers across Reddit and Japanese crypto forums. What surprised me was not the reach. It was the emails from people who had already bought in, telling me they had never opened the whitepaper — they had opened the Telegram.
The lesson was not that bad projects exist. It was that the information required to identify them was already public, and the crowd had simply traded reading for belonging. The ledger remembers what the crowd forgets.
Three years later, during DeFi Summer, I organized a volunteer squad of thirty university peers to translate Aave and Compound documentation into Japanese. Twenty simplified tutorials, weekly Spaces, ten thousand cumulative listeners. When one of the protocols we had recommended took a flash loan hit, I ran the crisis communication myself — walked users through the exploit line by line, showed them the fix, showed them the balance sheet. No panic. Because fear does not come from bad news. Fear comes from not understanding the news.
So when I say the N/A report is dangerous, I am not speaking theoretically. I have watched what happens when people are handed structure without substance, and then asked to stake their savings on it.
How Diligence Became a Format
The empty report did not appear from nowhere. It is the natural product of three forces that converged between 2023 and 2026.
First, research got industrialized. Any team can now generate a forty-table framework in an afternoon — supply schedules, competitive matrices, Howey test grids, risk matrices with fifteen rows. The scaffolds are free. The judgment is not. A framework is a question list. It is not an answer.
Second, the bull market turned analysis into marketing collateral. A project raising at a nine-figure valuation does not need to be understood. It needs to be documented. The report's function shifted from reducing uncertainty to manufacturing the appearance of process. Every N/A with a confidence rating is a small act of theater: it says, we looked, and there was nothing to see, and we are sure of it.
Third — and this is the part that keeps me up — the AI summarizers arrived. I built my own academy around AI tutors, ten thousand students a year, and I believe in the technology. But a model asked to produce an analysis of an analysis will faithfully reproduce the shape of rigor. It will fill tables because tables were in the template. It will label gaps with confidence, because confidence was in the tone. Nothing in the pipeline is incentivized to say the one sentence that matters: this founder has not published his token unlock schedule, and that is the entire story.
Follow the money and the incentive becomes obvious. Nobody has ever been fired for writing insufficient information. The blank is the safest sentence in this industry, because it can never be proven wrong. A claim of fraud can be litigated. A claim of ignorance cannot.
What the Blank Is Covering
Here is where I stop talking about reports and start talking about code, because the blanks are never random. There are exactly six fields an insider benefits from leaving empty, and I have watched all six of them hide behind an N/A.
The first is upgrade authority. Is the contract behind a proxy? UUPS or transparent? If it is upgradeable, who holds the admin key, and what is the multisig threshold? Three of five? Two of three? A two-of-three multisig among three wallets controlled by one person is not decentralization — it is a single point of failure wearing a committee's clothes. And if there is a timelock, what is the delay? Forty-eight hours gives the community time to exit. Zero seconds gives the founder time to leave first.
The second is the cliff, and the math is unforgiving. Take a token with a one-billion supply and a one-hundred-million float — a ten percent public circulation. Add a twelve-month cliff followed by a four percent monthly unlock. In year two, roughly forty-eight percent of the supply becomes liquid. If demand is flat, price does not fall because sentiment turned. Price falls because the market is being asked to absorb nearly half a supply that did not exist the year before. No amount of community enthusiasm digests that. This is arithmetic, not opinion, and it is why the vesting table is the one page I photograph first.
The third is value capture. Does the protocol have revenue, or does it have emissions? A lending market earning fees it distributes to token holders is a business. A lending market paying depositors in its own inflationary token is a customer acquisition budget with a governance vote attached. The tell is simple: compare real revenue to token-denominated incentives. If the second dwarfs the first, the yield is not a return. It is a transfer from future buyers to present ones. Points programs are the softest version of this, because points have no supply schedule at all — which means the dilution is real and the disclosure is voluntary.
The fourth is oracle and MEV exposure. Which price feed? Who controls it? Is the sequencer centralized on an L2, meaning the operator can reorder transactions at will? MEV is not a footnote. It is a tax levied on your users by whoever sees the mempool first, and it does not appear anywhere in a token table.
The fifth is approval surface. Every unlimited ERC-20 approval a user grants is a standing liability, and every protocol that requests one is choosing convenience over user safety. I have watched modest exploits become catastrophic ones purely because approvals were never revoked.
The sixth is governance concentration. Not the model on the whitepaper — the actual distribution. Top ten holders, delegated voting power, voter turnout on the last three proposals. A DAO where fewer than a hundred wallets decide everything is a company with a press release.
Six fields. Every one of them publicly discoverable, usually within an afternoon. And every one of them capable of being rendered as N/A.
This is also why I am skeptical of complexity marketed as capability. Uniswap V4's hooks genuinely turn the DEX into programmable Lego, and I mean that as a compliment — but the complexity curve is brutal, and I expect it will scare off the large majority of developers who attempt it. Complexity is where N/As breed, because fewer people can read the code well enough to contradict the summary.
By contrast, consider PayPal's decision to launch PYUSD. You can disagree with the strategy and still notice the structural difference: a player that chooses to become legible to regulators has to publish its numbers. Legibility is not virtue. But it does remove the option of leaving the important cells empty.
The Blank Is a Product, and the Opposite Error Is Worse
Let me be contrarian about my own outrage for a moment, because there is a version of this critique that is lazy.
The blank is not a failure of the analyst. It is a product the market buys. When a research desk publishes a confident call, it inherits liability — social, reputational, sometimes legal. When it publishes insufficient information, it inherits nothing. It has performed diligence without risking a claim. In a market where being wrong is punished and being vague is rewarded, rational actors will be vague, and they will be vague in a format that photographs well. The forty-one tables are not a mistake. They are the moat.
Which brings me to the error nobody makes enough noise about. While everyone worries about analysts who say nothing, the more expensive problem is analysts who say too much with too little. A framework with fifteen risk rows, six categories, and probability estimates to two decimal places produces a feeling of precision that no on-chain data supports. Precision is not accuracy. A 0.3 probability of a smart contract exploit is not a number. It is a mood, formatted as math.
And there is one more thing, the one I have had to teach myself the hard way. Absence of information and absence of evidence are not the same thing. If you go looking for a vesting schedule and cannot find one, you have discovered a research gap. If you go looking and can prove the team has actively withheld a document that comparable projects publish, you have discovered a finding — a negative audit, and those are the most valuable artifacts in this industry precisely because they cannot be faked.
That distinction is the whole craft.
Truth is not consensus, it is verification. And verification requires you to distinguish between the thing you could not find and the thing that was never there.
What Diligence Looks Like When It Is Real
I run an academy now, in Tokyo, and I have a rule for every cohort: no report gets published without a signed methodology section. What was checked, what was found, what was searched for and not found, and who did the searching under their own name. It is a small ritual, unglamorous, slower than the alternative. It works. Since we started attaching names and methods to conclusions, student research has become less confident and vastly more useful.
The direction this goes next is already visible. Diligence will become verifiable rather than asserted — attestations signed on-chain, research provenance recorded and timestamped, audit findings that can be checked against a commit hash rather than taken on faith. When a report can be verified rather than trusted, the economics of vagueness collapse. A blank cell with a signature on it is a different object entirely from a blank cell in a template.
We build walls of code to protect hearts of flesh, and walls require blueprints that someone was willing to sign.
So the next time a document arrives at two in the morning, three thousand words long, every cell reading N/A, every section stamped with high confidence — ask the question the format was designed to prevent you from asking. Not what did they find.
Ask who wrote it, what they were paid, and what they were afraid of losing. The future is built by those who audit the present, and an empty table is still a table someone chose to build.