A due diligence report crossed my desk last month with nine sections and one repeated answer. Technical architecture: not determinable. Token distribution: not determinable. Governance concentration: not determinable. Supply schedule, custody design, jurisdictional posture: not determinable. The document terminated in a signature block, an overall rating of "low risk — insufficient data," and an invoice.
That is not a diligence report. It is a measurement failure wearing the costume of a clean bill of health.
The distinction matters more than usual right now. In a cycle where a freshly funded protocol clears a nine-figure valuation on a deck, an audit badge, and a Discord, the absence of findings gets priced as the presence of safety. Nine columns of N/A are not nine green flags. They are nine unanswered questions, and the market has quietly decided to answer them itself.
I have watched that substitution happen before. In late 2017 I spent three weeks reverse-engineering the 0x Protocol whitepaper, cross-checking its atomic swap math against the academic literature it cited, and filed a forty-page debrief on a slippage-tolerance assumption that the order book could not have satisfied under fragmentation. No response. Silence is not a rebuttal, but it is not an endorsement either. It is a gap, and gaps get filled with price.
The framework that produced those nine empty sections is not a bad framework. That is the uncomfortable part. It asks the correct questions: how is supply structured, who signs transactions, what happens under stress. The problem is that these frameworks are evaluated on completion, not on information. A report that returns nine N/As and a report that returns nine verified findings are both "complete." Only one of them is a document.
This is a structural feature of the current cycle, not a bug in any single analyst's process. Token launches in 2025 and 2026 are increasingly shipped by entities that are deliberately under-described: no named jurisdiction, no vesting disclosure, a documentation site that describes intent rather than mechanism. The diligence checklist has become a target to be optimized against, in the same way that a proof-of-reserves attestation is optimized against by anyone who controls both sides of the transfer.
The result is a scoring inversion I have now seen in four separate diligence engagements over eighteen months. A project that publishes nothing scores cleaner than a project that publishes something imperfect. The first triggers no flags. The second triggers three. Procurement is risk-averse, so procurement picks the blank page.
Start with the epistemology, because the rest follows from it.
In May 2022 I spent two months mapping the LUNA/UST reflexivity loop, tracing the causal chain from the Anchor yield subsidy through the mint-burn arbitrage to the death spiral. That case is instructive precisely because it was not a null result. The collateralization field was not blank. It was explicitly, structurally zero, and every participant had access to that number. The failure was not measurement. It was interpretation — the field existed, the value was legible, and the market read a documented design choice as an unproven theoretical concern.
Null results are worse. When a field is blank, you cannot distinguish between three states: the information does not exist, the information exists and is bad, or the information exists and is fine but nobody asked. These three states have radically different risk profiles and identical visual representations. A blank field is not a clean field.
To test what that ambiguity is worth, I coded the comparison. Nine dimensions, each carrying a prior failure probability derived from the forty-one post-mortems I have compiled since 2018. For custody and governance, non-disclosure tracked failure rates above forty percent within twenty-four months. For token supply structure, above thirty. I ran the joint distribution assuming independence, which is generous, because these failures are empirically correlated. The composite probability that a project with nine blank dimensions suffers at least one material failure inside two years settled near seventy-eight percent. The framework's own rating for the identical input was "low risk."
That is not a rounding error. That is a sign inversion.
There is an incentive gradient here that is rarely stated out loud. A flagged risk that turns out to be fine is a visible error: the analyst killed a deal, and the deal's subsequent performance is public. A blank field that conceals a failure is an invisible error, because the framework never asserted anything in the first place. The first mistake is attributable. The second is not. So rational analysts under a reputational constraint will systematically prefer omission to assertion, and the aggregate output of the diligence industry drifts toward documents that describe the shape of a project without ever making a falsifiable claim about it. Every blank field is a decision somebody made, and most of those decisions were made for reasons that have nothing to do with the asset itself.
The compliance column deserves separate treatment, because it is the one where a blank gets actively manufactured. Most project KYC is theater. I have tested the boundary repeatedly: accumulating a meaningful position in a supposedly access-restricted offering through a small set of wallets with no relationship to the identity that passed verification. The gate exists. The gate costs money to operate. That cost is then passed to the users who comply, who pay in documentation, delay, and jurisdictional exposure, while the non-compliant route stays cheaper and faster. A compliance regime more expensive for honest participants than for dishonest ones is not compliance. It is a toll.
In early 2024 I pulled apart the custody specifications behind the newly approved spot Bitcoin ETFs, focusing on the multi-signature and cold-storage arrangements the filings described. The headline claim was institutional custody. The mechanism was a corporate trust with a signing quorum controlled by a single custodian. That is a legitimate structure — it is simply the structure that existed in 2019 under a different label. Ownership is an illusion without immutable proof, and a custodian's attestation is not proof. A promise with a reporting schedule is still a promise. The decentralization language in those filings survived legal review because legal review does not read signature thresholds as a decentralization metric. It reads them as an operational risk.
The same pattern governs interoperability. IBC is one of the few genuinely well-specified protocols in the space — light-client verification, deterministic packet ordering, no trusted relay assumption. It is elegant. The application chains built on it are sovereign: they keep their own fees, run their own validator sets, and route value around the hub rather than through it. ATOM's value capture is a governance claim, not a fee claim, and governance claims do not settle on-chain. Last quarter I traced fee flows across fourteen IBC-connected chains for a client memo. The hub's share of end-user fees landed in the low single digits, and most of that was relayer subsidy rather than economic rent. A protocol can be correct and still be a bad business. Those are separate columns, and diligence frameworks routinely collapse them.
The bulls are not wrong about everything, and the strongest version of their case deserves a hearing. A project with nine blank dimensions is often a project with a small attack surface. Pre-launch protocols genuinely have no token distribution to disclose, no governance history to measure, no treasury to audit. Marking those fields N/A is accurate rather than evasive. I have reviewed early-stage codebases where the honest answer to half the framework's questions was "not yet determinable," and penalizing that answer would have pushed the team toward inventing disclosures — a strictly worse outcome.
There is also a real cost to the completeness mandate. Frameworks that require nine populated sections produce nine populated sections. Some of those sections will be filled with narrative rather than data. In my experience, the projects with the most polished diligence documentation are frequently the ones with the most practice producing documentation.
But the concession has a boundary. Early-stage blanks resolve over time; they do not persist through a nine-figure raise, a mainnet launch, and two vesting cliffs. When the same field is still N/A after eighteen months, it has stopped being an open question and started being a disclosure decision. That is the moment a null result stops being neutral. It becomes a finding.
The next wave of post-mortems is already written. It lives in the empty cells of diligence reports that were commissioned, paid for, and signed off as low risk. The question for the cycle ahead is not whether the data existed. It is who accepted a blank field as an answer, and what they were paid to do so.
