Twenty-nine pages. Nine analytical dimensions. Roughly 140 table cells. Every one of them reads N/A.
That is the document that landed on my desk last week โ a second-stage risk report on a tokenized asset I won't name, produced by an automated diligence pipeline a mid-sized fund has been running since last spring. Stage one, the module that decomposes source material into structured information points, returned an empty array. Stage two, the module that grades technology, tokenomics, market position, ecosystem, compliance, team, risk, narrative, and supply-chain transmission, dutifully graded nine categories of nothing.
The footer carried the verdict in capital letters: INCOMPLETE โ INPUT DATA IS EMPTY. Somewhere between that footer and the investment committee memo, "INCOMPLETE" became "no material risk identified."
That transformation is the story. Not the broken pipeline โ pipelines break. The story is what the industry does with the corpse. The exploit wasn't in the smart contract. It was in the document that cleared it.
Automated due-diligence pipelines are not new, but their role has changed. Through 2021 they were triage tools: a first pass to decide which of 400 new deployments deserved a human week. Since the 2024โ2025 contraction, they've been promoted. Headcount went down; coverage expectations did not. Funds that once ran six analysts now run two analysts and twelve feeds. The pipeline is no longer a filter in front of the judgment. In many shops, it is the judgment.
The architecture is uniform enough to describe generically. Stage one ingests source material โ a whitepaper, an audit PDF, a governance thread, an on-chain data pull โ and decomposes it into atomic information points: the smallest independently verifiable factual units. Stage two consumes those points and fills a fixed analytical template.
The template is where the trouble lives. A fixed template cannot distinguish between "we looked and found nothing" and "we never looked." Both produce the same output: an unfilled cell. A human analyst writing "no anomalies found" is making a claim. A machine writing "N/A" is making no claim at all. The two strings sit in adjacent columns and read identically to anyone skimming.
I've spent twenty-seven years reading these documents and the last eight auditing the contracts underneath them. The empty report is more dangerous than the fraudulent one, because nobody has a process for rejecting it.
Let me dissect the anatomy.
Failure mode one: null propagation without validation. The pipeline accepted an empty information-point array as valid input. No schema constraint required a nonzero length. No alert fired. Stage two executed exactly as specified and produced a structurally perfect document. The system did not fail. It succeeded at the wrong task.
This is the same class of bug I found in 2018 during the 0x Protocol v2 sprint โ eight weeks of dynamic analysis, three reentrancy vulnerabilities in exchange logic that prior auditors had walked past. Those bugs weren't exotic. They were ordinary functions behaving correctly given inputs the developers never imagined arriving. Reentrancy is recursion with better branding. Null propagation is reentrancy for data.
Failure mode two: the neutral-N/A fallacy. The report carried a risk matrix with six categories โ technical, market, operational, regulatory, competitive, narrative โ each marked N/A, with probability and impact columns also marked N/A. Then a line: comprehensive risk rating, unable to assess.
Read that again. Six rows of a risk table with no risk entries. To a compliance officer under deadline, six empty rows look like six cleared rows. The document tried to prevent this โ buried in the risk section, one sentence noting that inability to assess is not equivalent to absence of risk. Correct. Also invisible. It was the fourteenth line of a paragraph in a document with 140 table cells, and tables win the reader's attention every time.
In audit practice we have a name for this. When an auditor cannot obtain sufficient appropriate evidence, they do not issue a clean opinion with footnotes. They issue a disclaimer of opinion, and the disclaimer goes at the top, in bold, because the profession learned โ expensively โ that readers do not read footnotes. The automated diligence industry has not learned it.
Failure mode three: the checkbox mirage. The report carried a standard risk-flag block: unaudited code, centralized sequencer, excessive admin privileges, extreme technical complexity, no peer review. Five boxes. All rendered unchecked, because there was no evidence to check them against.
Blank checkboxes are the most dangerous glyph in due diligence. An unchecked box communicates "not present." It does not communicate "not evaluated." In the same year I audited fifteen top NFT projects and found 60% shipping unsafe approval mechanisms vulnerable to signature replay, the flags that mattered were the ones nobody had thought to invent a checkbox for. Standardization fails when it ignores human chaos. A template that can only answer yes or no will always answer no when it means "I don't know."
The report's authors knew. Their remediation section is the sharpest part of the document: enforce a minimum information-point threshold before stage two runs at all; halt and alarm when the count is zero; never let an empty report enter a downstream decision queue. They wrote the fix. They wrote it in the appendix of the broken artifact, addressed to nobody. In code, silence is the loudest vulnerability.
Here is what the pipeline's critics get wrong.
The popular read is that this is automation failing โ that a human analyst would never have shipped twenty-nine pages of N/As. False. I have watched junior analysts pull the wrong Etherscan filter, miss a proxy contract, and produce an equally empty worksheet with total confidence. The manual version of this bug predates the automated one by decades. Automation did not create the empty report. It created the empty report at scale, in twelve seconds, with consistent formatting and a PDF export button.
And the system's designers did one thing right that almost nobody acknowledges: they refused to fabricate.
That sounds like a low bar. It is not. The default behavior for a language-model-driven diligence tool under an empty prompt is to generate plausible findings โ a described team, an inferred token distribution, a risk section with texture. Those outputs are unfalsifiable at a glance and catastrophic at scale. This pipeline returned nothing because there was nothing to return. The blockchain remembers, but the auditors forget โ and at least this one remembered to say so out loud.
The bug is not in the machine. The bug is in the interface between a machine's honest null and a human's need for a green light. Logic is binary; trust is a spectrum, and the industry keeps collapsing the second into the first.
So here is the requirement I would write into every diligence contract, starting now: status must be a first-class field, not an empty string. Every automated report carries a machine-readable state โ COMPLETE, PARTIAL, INCOMPLETE โ and downstream systems refuse to consume anything that is not COMPLETE. An empty array must never be able to impersonate a clean bill of health.
This stops being academic the moment autonomous agents start sizing positions off these documents. I audited an agent framework this year that frontran its own trades because a decision threshold was never validated against live conditions. A null that parses as neutral is the same bug wearing a suit.
When your risk report finds nothing, ask the only question that matters: did it find nothing, or did it simply not look?