The report was nine sections long. Every field resolved to the same three words: insufficient information.
Not one section was blank. Each carried a header, a table, a column of conclusions, a risk matrix with six rows. The formatting was flawless. The findings were zero. Under Technical Analysis, the innovation score was N/A. Under Token Economics, the supply schedule was N/A. Under Regulatory Compliance, all four prongs of the Howey test returned N/A. Under Risk, the composite grade was N/A. Nine domains, more than forty sub-metrics, and not a single value that could be evaluated — because the object the report existed to analyze was never delivered to it.
The information point list was empty. Zero items. The title field, the source field, the domain tag: all empty.
This was not an asset with no risk. This was a pipeline with no data. The distinction is the whole argument.
The pipeline spoke. The logic was a lie — or, more exactly, there was no logic, only the architecture of one. And the architecture held. It refused to fill the void.
That refusal is the most interesting event in the document, and almost nobody downstream is equipped to read it.
The two-stage machine
Automated due diligence stopped being a novelty around 2024 and became infrastructure by 2025. The architecture is consistent across vendors, because everyone converged on the same clean separation. Stage one parses a source — a whitepaper, a filing, a thread, an audit — and decomposes it into "information points": atomic claims with provenance attached. Stage two reasons over those points: technical feasibility, token emissions, market structure, regulatory exposure, team, governance, narrative. Two stages. Clean interface. Easy to sell into a procurement process.
The premise is elegant. You cannot reason about what you have not extracted. So you extract first, then you reason. Garbage in, garbage out is the folk version. The institutional version is worse: garbage in, confident report out, because stage two is a reasoning engine and reasoning engines do not know when they have been handed nothing. They only know how to reason. Ask them to reason over an empty set and they will do it flawlessly.
The demand side is what matters here. By early 2026, most of the mid-tier funds I speak with route at least part of their first-pass screening through a model. Not the final allocation — the screening. The funnel. The thing that decides which twenty of four hundred assets deserve a human's afternoon. That is a market participant now. It is not a tool sitting beside the desk. It is upstream of the capital, and the humans downstream trust its output the way they trust a Bloomberg field: as a fact, not an inference.
So when stage one returns an empty array, the failure is not the empty array. The failure is the contract between the two stages. Stage one returned nothing. Stage two had no clause requiring a non-empty input. So stage two ran its entire framework against the void, produced a structurally valid artifact, and — to its credit, and this is the part I will defend later — labeled every conclusion N/A instead of inventing one.
Most systems would not have. Most systems would have hallucinated. And a hallucination, at least, is visible.
But let me be precise about what "N/A" is, because it is not a neutral string. It is a value. It occupies a slot in a schema. And schemas are consumed by code.
The validation gap
Here is the shape of the pipeline in pseudocode, and I use Solidity syntax deliberately, because the type discipline is the point:
function analyze(Point[] calldata points) external returns (Report memory r) {
for (uint i = 0; i < points.length; i++) {
r = r.merge(infer(points[i]));
}
return r; // returns a well-formed struct even when points.length == 0
}Read the loop condition. i < points.length. When points.length is zero, the loop body never executes. The function does not revert. It does not throw. It returns r — an empty struct, but a valid empty struct. Every downstream consumer receives a Report. Nothing in the type system says the report is empty. Nothing in the ABI says the analysis never happened. The function signature promises a Report, and a Report is exactly what it delivers. The contract is honored. The work was never done.
This is not a bug in the reasoning. This is a missing require.
require(points.length > 0, "EMPTY_INPUT");One line. It is the difference between a system that can fail loudly and a system that fails silently while emitting a success code. I have seen this exact pattern in production contracts more times than I can count: the absence of a guard is invisible, because its absence produces no error. A missing check never throws. That is why it survives review. You cannot grep for a line that was never written, and you cannot test for a revert that never fires.
In my 2025 audit of an autonomous AI-agent protocol, I found the mirror image of this. The oracle feed validation had no cryptographic signature requirement at the boundary — the data path was trusted by construction, and nothing verified it on entry. I simulated ten thousand attack vectors to prove the exposure; the team paused the launch. The lesson I carried out of that engagement was not about AI, and not about oracles. It was about boundaries. Every place where one system hands data to another is a place where trust is assumed and should be earned. A pipeline without an input gate is not a pipeline. It is a suggestion.
How "unknown" becomes "safe"
Now the part that should keep people awake.
The report was honest. It said N/A. But suppose, as is standard, the schema encodes "N/A" as a zero. An enum defaults to index 0. A uint8 defaults to 0. A missing field in JSON deserializes to 0. So riskLevel is 0. And downstream, some allocation script or dashboard or agent does this:
uint8 risk = report.riskLevel; // 0 when unset, 0 when "unknown"
if (risk == 0) { deploy(capital); } // "unknown" is read as "safe"The report said "I do not know." The system heard "no risk." The translation happened in a single line of code that nobody wrote on purpose.
This is the cascade failure the report itself flagged, and it flagged it correctly: if a downstream decision system cannot distinguish "empty input" from "clean bill of health," then an input pipeline outage does not produce a gap in analysis — it produces a false signal. The analysis did not stop. It inverted. Silence became a buy.
I have spent ten years watching this pattern in less automated forms. The DeFi Summer of 2020 taught me that abstract math reveals truths that sentiment obscures. I spent three hundred hours on Compound's rate curves and found a liquidity-incentive flaw that surfaced during high volatility — something no price chart would ever show. The math did not lie. The math was simply not read, because the market was reading the narrative instead. Same structure here, one layer down. The value was present, encoded, correct, and the consumer was blind to it. Data does not lie, but it does not care — and it will not raise its voice to be heard.
The one thing that worked
Let me give the pipeline its due, because the credit is real and it is the hinge of this entire piece.
The framework contained a constraint: no speculation. Every conclusion must trace to a source information point. When the information points were empty, the framework could not manufacture a conclusion without violating its own rule. So it did not. It returned nine sections of N/A and an explicit action item: rerun stage one; verify the parse module retrieved the body text; check whether the extraction logic fired at all.
That is a self-diagnosing system. It knew it had failed. It said so, in the document, in a section addressed to the caller.
Compare that to the human baseline. I know the human baseline. In 2021, dissecting the Luno protocol, I found a reentrancy vector in their staking mechanism — an authorization check missing at the withdrawal path, the same class of missing-guard defect I described above, and the same class that has drained hundreds of millions across the ecosystem since. The team asked me to sit on it. "Community sentiment," they said. The incentive gradient pointed at silence. I published a fifteen-page report instead; the mainnet launch halted; the token fell forty percent.
A human analyst under deadline, with a client waiting and a retainer on the line, does not return nine sections of N/A. A human analyst returns something. That is the entire bull case for machine diligence, and it is not weak: the machine has no incentive to lie, because the machine has no incentive at all. It cannot be flattered. It cannot be paid to look away. It has no community sentiment to protect and no launch to protect.
So the pipeline that said nothing is, in one narrow and important sense, the most trustworthy actor in this story. It is the only participant that did not perform.
What the bulls actually got right — and where it breaks
Here is the contrarian read, and it cuts against my own instinct to condemn the machinery.
The bullish case for automated due diligence is not speed. Speed is a side effect. The real case is calibration. A system that will say "insufficient information" is a system whose "buy" signals carry information, because it is capable of not-buy. A research desk that never says "I don't know" is not a research desk. It is a marketing function with a Bloomberg terminal. On that axis, the null report is a feature. It proves the framework can refuse. Very few can.
But the bull case breaks on contact with the market. Incentive-free honesty is also incentive-free usefulness. Nobody pays for calibration. They pay for conviction. The null report is commercially dead: it recommends no position, names no entry, triggers no flow. A confident report that is wrong eighty percent of the time will out-earn an honest report that is silent, because the confident report generates trades and the honest one generates nothing. The market does not reward the absence of error. It rewards the presence of a story. This is not cynicism. This is the same incentive gradient that made Luno's team ask me to be quiet — it does not care whether you are a person or a process. It prices output, not accuracy.
This is the fault line. They built a palace of automated diligence on a foundation of unvalidated inputs, and the palace is beautiful — the schema is clean, the reasoning is sound, the framework is disciplined — and it sits directly on top of a boundary where data arrives unverified and unchecked. The building is fine. The ground is not.
The pipeline did not fail because it was weak. It failed because the connection between its two halves was assumed rather than enforced. Trust is a variable you cannot hardcode — and every system that tries eventually ships a report that says nothing and a downstream consumer that hears everything.
The audit question nobody is asking
When I ran the 2022 layer-2 audit — six months off social media, fifty pages of fraud-proof analysis — I found that two of the three projects I reviewed relied on centralized fault proofs while marketing decentralization. The gap between the claim and the mechanism was the finding. Here, the gap is subtler and more dangerous: the claim is "we analyze assets," the mechanism is "we analyze whatever stage one hands us," and stage one can hand us nothing.
The monitoring gap is structural. Who watches the input boundary? In most deployments: no one. There is no heartbeat on stage one. There is no null-check alarm. There is no circuit breaker that trips when the information point count drops to zero. The pipeline is instrumented for throughput — points per second, latency, cost per report — and not for emptiness. An outage that produces fewer inputs looks like an efficiency gain. A silent failure that produces zero inputs looks like a fast report. The metrics are green. The machine is hollow.
So the audit question is not "is the model good?" The models are good. The question is: can your pipeline distinguish "nothing to analyze" from "nothing to worry about," and can anything downstream hear the difference? If the answer is no — and in most stacks I have examined, it is no — then the risk is not model quality. The risk is that a good model, handed an empty array, produces a clean-looking artifact that a downstream allocator reads as a green light.
Takeaway
The next blow-up in automated crypto research will not be a hallucination. Hallucinations are loud; they get caught; they get corrected; they become training data. The next blow-up will be a null — an empty input, a valid-looking report, and a consumer that could not tell "unknown" from "safe." The report that said nothing was the honest one. The danger is the system that reads it and hears a buy.
Ask your vendors one question. Not what their model can do. Ask what happens when it is handed nothing, and who is told. If the answer involves the word "gracefully," you have found your fault line.
The code spoke. The logic was a lie. And the only thing that saved the system was that, for once, it admitted it.