The N/A Report: Crypto Due Diligence and the Economics of Saying Nothing

The report was nine sections long and contained no information.

I read it twice to make sure. Section 1: technical positioning — N/A. Section 2: token supply structure — N/A across all four rows: team, early investors, community, treasury. Section 3: market positioning — N/A. It continued like that through ecosystem role, regulatory compliance, team and governance, risk matrix, narrative, and supply-chain transmission. Forty-plus table cells. Two sentences of analyst note at the bottom, which I will paraphrase rather than quote: the framework is ready, awaiting valid input.

Then it was forwarded to three limited partners.

I have been on both sides of this. I audited 0x Protocol v2 line by line in 2018 and filed seven edge-case findings in the relayer logic directly to GitHub because there was no other channel. In 2021 I read 500-plus NFT minting contracts and found a rounding error that allowed unbounded minting on a CryptoPunks derivative. Neither of those projects handed me a template. Both of them produced raw facts that anyone with a node could reproduce. That difference — reproducible versus asserted — is the whole subject here.

The nine-dimension framework is not an anomaly. It is an artifact of the post-2022 correction, when allocators decided that discretion had failed and standardized process would replace it. The logic was reasonable. Terra proved that a well-told story could route capital into a mechanism with a structural death condition. The institutional response was to decompose due diligence into a fixed schema: technology, tokenomics, market, ecosystem, compliance, team, risk, narrative, transmission. Score each. Weight them. Produce a composite.

Copy-paste did the rest. The schema is now embedded in fund memos, exchange listing committees, and at least two grant programs I know of. It has become infrastructure. And infrastructure deserves the same treatment I give a bridge contract — not "is it useful," but "what are its invariants, and where do they break."

So treat it as a protocol. Inputs: claims. Transformation: a mapping from each dimension into a rating space. Outputs: a composite judgment. Fixed schema, deterministic path, stated objective — reducing variance in capital allocation.

What is the invariant of a protocol whose output space includes N/A as a terminal state?

The structural flaw is not that the template returns null. It is that null propagates.

In software, null is a first-class value, and every downstream consumer of that value must decide what to do with it. In a correct system, null halts execution or triggers an explicit default. It does not silently compose into a verdict. The nine-dimension framework does the opposite:

dimension_scores = [N/A, N/A, N/A, N/A, N/A, N/A, N/A, N/A, N/A]
composite       = weighted_mean(encode(dimension_scores))
# encode = {High: 3, Medium: 2, Low: 1, N/A: 2}  <- undocumented, and this is the bug

The N/A is coerced to a neutral midpoint somewhere in the weighting step. Nine unknown values average into a confident-sounding number. I have watched this happen in real memos. The composite lands at 5.5 out of 10 and gets read as "caution" when the correct reading is "we have no model of this asset."

Now the second-order problem, which is where I lose patience.

The nine dimensions do not differ in verifiability. They differ enormously. Supply structure, vesting cliffs, team wallet concentration, treasury balances, contract admin keys — these are on-chain objects. They are not opinions. You do not need an interview, a deck, or a disclosure. You need a block explorer and the patience to read a storage slot.

I pulled a vesting cliff out of a Linear-style vesting contract in twenty minutes last month. Two storage slots, one arithmetic decode, and I had the exact block at which 34% of circulating supply unlocks. That is not special skill. It is the cost of caring.

I know the counterargument, because I have made it myself. In 2020 I spent three months on the Groth16 trusted setup ceremony behind Zcash's shielded pools — a subject with genuinely thin public evidence, where the honest output is a distribution over adversary models rather than a rating. That is what real uncertainty looks like on a page: formal notation, stated assumptions, and a boundary. It does not look like a table of N/A. Even the most abstract cryptographic claim has verifiable artifacts — ceremony transcripts, powers of tau, transcript hashes. If a tau ceremony can be audited by a stranger, a vesting schedule can be read.

So when a report returns N/A on "team allocation," it is not reporting an absence of information. It is reporting an absence of work. Those two things look identical on a page and are completely different in a capital allocation decision.

Run the inversion explicitly. Sort the nine dimensions by how much of the required input is publicly verifiable:

• Fully verifiable: supply structure, unlock schedule, treasury, admin permissions, contract upgradeability.
• Verifiable with caveats: DAU/MAU, retention, TVL — measurable, but sybil-contaminated and worth discounting rather than rating.
• Genuinely off-chain: legal structure, Howey elements, team stability, intent.

The template's N/A density should be near zero on the first bucket, moderate on the second, and concentrated in the third. In the report I received, it was uniform. Uniform N/A across a mixed-verifiability schema is a signature — it fingerprints the analyst, not the asset.

The check itself takes an afternoon. Query the token contract's total supply. Enumerate holder concentration from transfer logs rather than from a dashboard that indexes them for you. Read the admin key's owner and whether it sits behind a multisig with a published signer set. Decode the vesting contract's storage to get cliff and linear-release terms. Pull treasury addresses from the governance forum and confirm the balances on-chain. There is no dimension in this list that requires permission, disclosure, or trust. There is only the decision to look. Based on my audit experience, the findings that matter almost never come from the team's own reporting. They come from the gap between what the reporting says and what the storage slot contains.

There is another layer, and it is the one that makes the template's behavior predictable rather than merely lazy. Look at the incentive structure.

Three feasible outputs for an analyst: bullish, bearish, null.

• Bullish and correct: reputation accrues to the analyst. Bullish and wrong: the framework's section 7 "flagged" risks, and the analyst is credited with disclosure rather than judged for error.
• Bearish and correct: the analyst is honest, briefly. Bearish and wrong: the analyst cost the fund a 40x and is remembered for it.
• Null: unscoreable. Permanently.

Null is the dominant strategy under asymmetric blame. It has zero variance in outcome. It cannot be wrong. Math doesn't return N/A — people do, and they do it because the payoff matrix punishes being wrong far more than it punishes being empty.

That is not corruption. It is equilibrium. The template did not fail to prevent N/A; it selected for N/A. A scoring rubric whose terminal state is unfalsifiable will accumulate that state, the way a lottery with a single winning digit accumulates losers.

Here is where I stop being even-handed.

Everyone reads the N/A report as a procedural failure. The interesting read is that it is functioning exactly as designed on the one dimension that actually carries legal weight.

Look at what the report did complete. The Howey test table. Four rows — money invested, common enterprise, expectation of profit, efforts of others — each mapped into a risk column, and a composite judgment row at the bottom. That is not a risk model. That is a memo that will be produced in discovery. Somewhere in a litigation or an examination, someone will open the file and point at the row that says "regulatory exposure: assessed."

The dimensions that would have generated uncomfortable findings — team wallet concentration, treasury control, foundation holdings, admin key custody — are precisely the rows that returned N/A. Traceable on-chain, unpriced on paper. Privacy is a protocol, not a policy — and here the protocol is silence, executed consistently.

I have seen this pattern at contract level too. The rounding error I found in that NFT minting contract in 2021 — infinite mint, trivially reproducible — was reported to the team and answered with nothing. Not a denial. Nothing. The contract kept running. The collection kept selling. An audit that produces no response is not an audit; it is a receipt. The N/A report is the same object in a different format: evidence that a process occurred.

And the timing is not incidental. The report updates when the allocator needs it to update — which makes it a price feed with a six-month heartbeat and no deviation threshold. Latency in the information layer, not the computation layer. The composite number is always fresh and always stale, because the underlying facts were never loaded.

This is the same failure mode I keep flagging in DeFi's price layer. A feed that reports a number without reporting its deviation threshold and heartbeat is not a price — it is a claim about a price. Chainlink's attempt to decentralize that layer with a permissioned node set moves the trust rather than removing it. The N/A report is that same architecture applied to diligence: a trust assumption wearing the costume of a metric.

The next iteration is predictable and I would guess it arrives within eighteen months. Attestations. Signed, timestamped, published, with the raw queries attached — block numbers, contract addresses, the exact storage slots read. A report you can fork and re-run. If the analyst wrote N/A on team allocation, the reader executes the same query and gets the same answer, or the analyst loses the badge.

Until that exists, apply the only test that survives contact with an incentivized market: treat every N/A as a claim rather than a gap, and every rating as a hypothesis rather than a finding. Trust is a vulnerability, not a virtue. In a bull market, the reports that say nothing are the ones that cost the most — because they are the ones that let capital move without a price discovery event ever occurring.

One question for the people who forwarded those nine pages. If your due diligence cannot be reproduced from a public block explorer by a stranger with no permission, what exactly did you buy?