A nine-section research report landed in my inbox on a Tuesday. Technical analysis. Token economics. Market structure. Ecosystem positioning. Regulatory compliance. Team and governance. Risk matrix. Narrative expectations. Supply-chain transmission. Every section was present. Every heading was formatted. And every cell โ all forty-seven of them โ read the same three letters: N/A.
The report concluded with a Core Judgment. It rated information value across four dimensions: technical, investment, timeliness, reference. All four: N/A. Then it appended a disclaimer, a glossary defining N/A as Not Available, and a closing instruction: return the effective first-stage deconstruction results, and I will immediately conduct substantive analysis.
This is not a failure. This is the product. The code does not lie; only the founders do. And here, the template was at least honest enough to admit it held nothing. The market it serves is not.
Context: The Industrialization of Due Diligence
Between 2024 and 2026, the demand for crypto research artifacts exploded faster than the supply of crypto facts. MiCA came into force across the European Union, and with it a compliance regime that requires CASPs to document, classify, and justify. ETF issuers needed cold-storage attestations. Family offices needed position memos. Venture funds needed sourcing decks. Everyone needed something to put in a folder so that a later auditor would see diligence had occurred.
The market answered with frameworks. Nine-dimension models. Scoring rubrics. Standardized templates with fixed fields โ team, supply, unlock schedule, Howey test, risk matrix โ that promised to convert any project into a comparable grid. These frameworks were not built to discover truth. They were built to be filled. A filled grid looks like work. An empty grid looks like an admission. So the industry learned to fill the grid regardless of whether there was anything to fill it with.
I have been on both sides of this. I have written the grids for institutional clients. I have audited the contracts that the grids were supposed to describe. And I have watched, repeatedly, as the grid became the deliverable โ the map sold as the territory, the checklist sold as the analysis.
Here is the mechanism, laid out the way I would lay out an exploit path. Not because it is malicious in every instance, but because it is mechanical. And mechanical failures are the ones that scale.
Core: The Five Laundering Steps
A template does not need data to produce authority. It needs only structure. The conversion from nothing to something runs through five steps, and each one is individually defensible. That is what makes the aggregate indefensible.
Step One: The Frame Confers Legitimacy
The moment a document has a section called Regulatory Compliance Analysis, the reader assumes that a regulatory analysis occurred. The heading is a claim. It asserts that a category of work was performed. In a well-built report, the heading is earned by the content beneath it. In a template, the heading is the content. The presence of the frame is mistaken for the presence of the finding.
I first understood this during the 2018 ICO cycle, when I manually audited the contracts of Project Aether. The whitepaper had a Security section. It was two paragraphs long and mentioned multisignature wallets. It did not mention the reentrancy vulnerability in the token sale function that let an attacker drain 40 ETH from the treasury before the team patched it. The section existed. The security did not. The heading was the product.
Nothing about that has changed. It has only been professionalized. The 2018 whitepaper section became the 2026 framework dimension, and the framework dimension now carries the added weight of looking like institutional methodology.
Step Two: N/A Is Rendered as Rigor
This is the subtle one. A field marked N/A can be read two ways. Either the analyst could not find the information, or the analyst is disciplined enough not to invent it. The second reading is the flattering one, and the industry defaults to it.
So an empty report gets credit for intellectual honesty it did not consciously exercise. The N/A becomes a badge. I have seen compliance memos where every quantitative field was N/A and the memo was praised in a partner meeting for being 'conservative.' It was not conservative. It was empty. Those are different things, and the difference matters enormously when the memo is used to justify a position.
If a report contains no information, then it cannot be wrong, and a document that cannot be wrong will always pass review. That is the entire trick. The safest possible artifact is one with no claims. The industry has learned to mass-produce the safest possible artifact and call it research.
Step Three: The Placeholder Becomes the Pipeline
Look at the closing line of the report in my inbox: return the first-stage results and I will immediately conduct substantive analysis. The empty document is not the end product. It is a request for input, dressed as an output. It is a sales funnel with a section header.
The structural consequence is that the empty template generates more work rather than less. It demands that someone else supply the facts. It positions the template author as the analyst who will do the real work once the data arrives. But the data never arrives in clean form, because if it did, the project would not need a nine-dimension framework to describe it. Clean data is rare precisely in the situations where the framework is deployed. The empty report is therefore self-perpetuating: it waits for input that the underlying reality cannot supply, and in the waiting it looks patient rather than vacant.
I don't trust the audit; I trust the gas fees. And a document that generates no on-chain action, no transaction, no measurable event, has no gas fees to trust. It has only its own formatting.
Step Four: The Risk Matrix Neutralizes Risk
Every framework has a risk matrix. Mine has one. The format is a grid: risk category down the left, severity, probability, impact, mitigation across the top. The grid is supposed to concentrate attention on the largest threat.
In practice, an empty grid does the opposite. When every cell reads N/A, the reader's eye stops treating the matrix as a warning system and starts treating it as a completeness check. The matrix looks handled because it is fully populated with a uniform value. Uniformity reads as control. A page of N/A looks tidier than a page with three red cells and four unknowns, even though the latter is infinitely more informative.
I ran into the real version of this in 2020, during DeFi Summer, when I stress-tested Compound's interest rate models on a local fork for weeks. I found a rounding error in the borrow rate calculation that could push the protocol toward insolvency under high volatility. I reported it. The core developers acknowledged it. They prioritized liquidity incentives over an immediate fix. The risk was known, documented, and deprioritized โ because the incentive structure rewarded TVL growth in the short term and punished caution. A risk matrix would have shown that trade-off. A framework that only records what is comfortable would have shown N/A.
The difference between a risk matrix and a risk is that one of them has a position attached.
Step Five: The Disclaimer Absorbs the Blame
At the bottom of every report sits the disclaimer: not investment advice, high risk, do your own research. It is legally necessary. It is also, functionally, an escape hatch. It transfers responsibility from the document to the reader while the document continues to look authoritative in every other respect.
Combine the disclaimer with the empty template and you get a document that projects expertise, contains nothing, and blames the reader for relying on it. That is a remarkable engineering achievement. It is the financial equivalent of a contract that executes but transfers no value, wrapped in enough gas to make the transaction look real.
The rug was pulled before the mint even finished. In the MetaBeast case in 2021, I analyzed the minting contract and found the owner function lacked access controls โ anyone could pause minting or mint infinite tokens. Early buyers were warned. The project launched anyway. I shorted the governance token. Two weeks later, the rug pull wiped out two million dollars. The warning was on-chain, verifiable, and public. It still did not matter, because the community was reading a roadmap, not a contract. An empty N/A report would have been more honest than that roadmap. It would also have been ignored for the same reason.
Core, Continued: What an Honest Empty Report Actually Looks Like
I want to be precise, because the framework defenders will say that structure is the point. Fine. Structure is a tool. Let me show what a tool looks like when it is aimed at reality instead of at a sales pipeline.
When I audited the Luna Classic peg mechanism after the 2022 collapse, I did not fill a template. I proved that the algorithmic backstop was mathematically impossible to sustain, and I cited the specific oracle manipulation vectors that accelerated the death spiral. The report had a position. It named the mechanism that failed. It was cited by EU regulators as evidence of predatory design, not because it was comprehensive, but because it was specific. Specificity is the only thing a regulator or an investor can act on. N/A is not actionable. It is inert.
When I led the cold-storage audit for a major ETF issuer in 2025, I found a side-channel vulnerability in the multisignature wallet implementation that could leak private keys through timing attacks. I demanded a full rewrite of the signing logic. It cost the client five hundred thousand dollars in delays. It prevented what could have been a billion-dollar breach. That finding did not emerge from a template. It emerged from staring at signing latency until the pattern showed itself. No framework dimension is called 'timing attack surface.' You have to want to find it. A grid cannot want anything.
So here is the honest empty report. It says: I have no data on the token supply because the team has not published the contract address. I have no data on the team because three of the four listed members have no verifiable history. I have no data on revenue because the protocol has no revenue, only emissions. I cannot assess regulatory risk because the entity is registered in a jurisdiction that does not answer requests. And then it says the only thing that matters: therefore, do not buy this, and do not pretend you did the work.
That report is short. It is uncomfortable. It is useful. Nobody commissions it, because it cannot be reused, cannot be templated, and cannot be resold to the next client with the name changed. The empty nine-dimension report can be resold forever. That is the business model.
Contrarian: The Template Builders Are Right About One Thing
I will give the framework industry its due, because a cold analysis that only attacks is just marketing in reverse. The template builders understood something that the pure skeptics miss: without structure, most crypto diligence collapses into vibes.
I have watched brilliant analysts produce worthless notes because they had no frame. They read the whitepaper, felt good about the founder's Twitter presence, and wrote a paragraph. Their instinct was sound and their output was unusable. A rigid grid forces the lazy analyst to confront fields they would rather skip โ unlock schedules, governance concentration, oracle dependencies. Even when the fields are filled with N/A, the act of encountering them is a small discipline. The template is a crutch, but it is also a checklist, and checklists have saved more systems than heroes have.
My objection is not to structure. My objection is to structure used as a substitute for evidence, and to the specific incentive that rewards the empty grid because it is frictionless to produce and impossible to falsify. The template is not the enemy. The unearned confidence the template confers is the enemy. Strip the confidence and keep the structure, and you have something genuinely useful โ a scaffold that makes it obvious when a project has nothing behind it.
Reentrancy is not a bug; it is a feature of trust. The same is true of the framework. It is not a bug in the diligence process. It is a faithful feature of an industry that prefers the appearance of verification to the cost of it.
Takeaway
The empty report in my inbox was the most honest document I received that week. It said N/A forty-seven times and meant it. The reports that surrounded it said 'strong team' and 'innovative technology' and meant nothing. One of those categories is a threat to capital, and it is not the one with the glossary.
The sideways market we are in is not waiting for a catalyst. It is waiting for evidence. The protocols that survive the next twelve months will not be the ones with the best frameworks describing them. They will be the ones whose contracts, gas flows, and unlock schedules can survive being looked at directly, without a template in the way. So the question for every analyst in this market is not whether they can fill nine dimensions. It is whether they are willing to publish the version where seven of them say nothing, and let that be the finding. The code does not lie. The frameworks already have.