A due-diligence pipeline returned a report last week. Nine sections. Technical architecture, tokenomics, market structure, ecosystem position, regulatory exposure, team and governance, risk, narrative, supply-chain transmission. Every field marked N/A. Every conclusion read the same phrase: insufficient information, cannot assess.
One row survived with real values. Risk matrix, data-integrity line: level High, probability High, impact High. The document then stopped writing.
That is the whole story, and it is more interesting than anything that shipped this month inside a ninety-page PDF with a green checkmark on the cover. A system was asked to analyze an asset it could not see. It declined. Then it told you why.
The crypto industry has industrialized the audit report. Templates are standardized. Nine dimensions, forty-two sub-metrics, a one-to-five star rating at the end. The output looks like rigor. Mostly it is formatting. In a sideways tape, when nothing pumps hard enough to hide bad code, diligence becomes the only edge left — so funds buy diligence products to show their LPs, not to inform their positions. Fee compression, flat retail volume, funding rates drifting near neutral for weeks. Something has to justify the management fee.
The pipeline in question ran in two stages: extraction, then analysis. Stage one pulled facts from a source document and returned an empty list. Stage two was instructed to anchor every claim to a numbered information point. Zero information points. It could fabricate, or it could abstain. It abstained, and it left the abstention inside the document, labeled, in the same font as a real finding.
Here is what most people miss. The failure was not in stage two. Stage two behaved correctly. The failure was in stage one, and whoever produced the final document had the discipline to report upstream breakage instead of papering over it.
That is rare. I have seen the opposite more times than I care to count.
In 2018, while a student in Warsaw, I manually audited Project Aether's token sale contract and found a reentrancy path that drained 40 ETH from the treasury before the team patched it. I posted the exploit chain on GitHub. The founders never replied. The whitepaper kept advertising audited smart contracts. The code does not lie; only the founders do. What made that episode instructive was never the vulnerability. It was the gap between the artifact and the claim about the artifact.
The same gap shows up inside scoring frameworks. Force an analyst to rate innovation, maturity, security assumptions, and performance on a one-to-five scale for a project with no public repository, and you will receive numbers. Not because the numbers are known, but because the form demands them. That is completeness theater — the substitution of a filled field for a verified fact.
Now scale it. Automated diligence tools run across thousands of tokens a week. If stage one fails silently and stage two fills gaps with plausible prose, you get hallucination at machine speed, distributed to institutional clients who price it into positions. A pipeline that outputs N/A is annoying. A pipeline that outputs confident garbage is a systemic risk.
I watched this trade-off unfold in 2020, stress-testing Compound's interest rate model on a local fork. A rounding error in the borrow rate calculation could push the protocol toward insolvency under high volatility. The core devs acknowledged the flaw. They prioritized liquidity incentives over an immediate fix. Financial engineering routinely outruns the arithmetic underneath it, because incentives are quarterly and solvency is theoretical until it isn't.
The 2021 MetaBeast minting contract made the same point louder. The owner function had no access controls. Any address could pause minting or mint without limit. Early buyers were warned. The launch proceeded anyway, the governance token got shorted, and the rug was pulled before the mint even finished. The contract's permissions were visible the entire time. Nobody reads permissions when the chart is green.
The empty report also exposes something subtler about how risk matrices get built. The only row that received a hard rating was the one describing the report's own input failure. Every other row was N/A. In other words, the single highest-confidence risk identified by the entire nine-dimension framework was the framework's own blindness. A due-diligence process, applied to an unnamed asset, concluded that its most probable point of failure was the diligence chain itself.
There is a lesson here for anyone building oracles, bridges, or cross-chain message layers. Stale data is more dangerous than absent data, because absent data is visibly absent and stale data looks fresh. A bridge that fails to receive a message should halt. An oracle that loses its feed should revert, not return the last price. An analysis pipeline with no inputs should return no conclusions. The empty report got this right. Most production systems do not.
The reflexive read on an N/A document is that it is useless. I disagree — and this is where the tooling maximalists are genuinely correct. At scale, refusing to hallucinate is worth more than any single finding. Automation does not get tired, does not develop relationships with founders, and does not soften a verdict to protect an advisory retainer. That independence has real value.
But consider the honest ceiling of any report. I don't trust the audit; I trust the gas fees. A report can be accurate and still worthless, accurate about a token nobody uses, describing a contract with no flow worth attacking. Reentrancy is not a bug; it is a feature of trust — the trust that someone else already checked. What no report measures is whether anyone wants the asset next month. That gets priced by order books, not PDFs.
So the contrarian angle is this: an empty report is negative for the project it describes and positive for everyone else. It tells you the data supply chain is broken before you wire capital into it. Absence of evidence, properly labeled, is evidence about the pipeline.
The blind spot among automation enthusiasts is assuming extraction never silently fails. It fails constantly — renamed fields, moved endpoints, paywalled sources, schema drift between template and parser. Nobody notices because the output still renders. Nine N/A rows are embarrassing. Nine confident rows built on a broken extraction step are a liability you discover only after the position is underwater. I spent part of 2025 on an ETF issuer's cold storage audit, found a timing side-channel in the signing logic, and forced a rewrite that cost the client half a million in delays. Nobody thanked me at the time. The alternative was a billion-dollar key leak.
The next cycle will not be won by more reports. It will be won by reports that can say "I don't know" and mean it — pipelines that fail loudly at the extraction layer instead of quietly at the narrative layer. When the source vanishes, does your model abstain or improvise? If your vendor cannot answer that question, they already have.