Hook
2:14 p.m., Chicago time, last Tuesday. I ran an eleven-field diligence query against a protocol that had announced a raise the week before. The output came back clean, formatted, and empty. Ten fields read N/A. The eleventh read "insufficient information."
I have been doing this since I was twenty-six years old, tracing contract deployment logs on Etherscan before "on-chain analyst" existed as a job title. In that time I have learned one thing that never shows up in a research template: a blank field is not neutral. It is a position. Someone chose not to fill it, or someone built a pipeline that never asked the question.
I closed the tab. Then I reopened it, because the blank output was the most interesting data point I had seen all week.
Cheetah.
Context
Crypto due diligence has industrialized over the last two years, and the industrialization has a tell. Nine categories. Sixty-odd fields. Technical positioning, tokenomics, market structure, ecosystem role, regulatory exposure, team and governance, risk matrix, narrative, supply-chain transmission. It looks like an audit. It reads like an audit. It produces something that is functionally a spreadsheet with a bow on it.
What it does not produce is a question about who can pause the contract.
That absence is not an accident, and it is not a criticism of any single template. It is structural. Automated pipelines optimize for coverage โ for the number of fields they can populate โ because coverage is measurable and questions are not. A pipeline that fills sixty fields looks like work. A pipeline that asks "who holds the upgrade key" looks like nothing until the answer is "a single EOA with a hot wallet and no timelock," at which point it looks like everything.
In 2017 the gap looked different. ICO whitepapers shipped with blank token-distribution tables and the market filled them in with optimism. I watched a project raise nine figures on a one-page "tokenomics" section that listed a total supply and nothing else. Nobody asked about the unlock schedule because there was no unlock schedule โ it had not been written yet.
Nine years later the blanks are still there. They are just better formatted.
โ Root: The ESTP
Core: The Anatomy of a Blank Field
Let me be specific about what "N/A" costs you.
Take the eleven-field output I got on Tuesday. Under technical positioning, the field for "security assumptions" was empty. Under tokenomics, "cliff and vesting" was empty. Under governance, "top-10 holder concentration" was empty. Under risk, the entire matrix was empty.
Here is the part that should bother you: an empty risk matrix and a fully populated risk matrix score identically in a coverage metric. Both are "complete." One of them tells you the analyst looked and found nothing to flag. The other tells you nobody looked.
The industry has no standard notation for the difference between "we checked, it's fine" and "we did not check." So both render as blank, and the reader โ who has been trained by eleven years of dashboards to trust structure โ reads both as "fine."
I have a rule from the 2017 Parity mess that I have never broken: verify the blank before you interpret it. In the Parity case, the whitepaper-level documentation was clean. It was the deployment logs that were not.
That distinction โ between what a project says and what its deployment footprint shows โ is the entire game. Cheetah.
Core: Verification Status Is a Disclosure
Start with the cheapest signal available, because it is free and almost nobody reads it: contract verification status.
An unverified contract on Etherscan is not automatically malicious. Plenty of legitimate teams delay verification during rapid iteration. But an unverified contract on a protocol holding nine figures of TVL is a disclosure in itself. It tells you the team has decided that readable bytecode is not a priority. That is a statement about their assumptions regarding who needs to audit them.
The more interesting case is the verified proxy. Run this against any proxy-based protocol and you get the live implementation address:
from web3 import Web3w3 = Web3(Web3.HTTPProvider(RPC_URL))
# EIP-1967 implementation slot SLOT = "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc"
raw = w3.eth.get_storage_at(PROXY_ADDRESS, SLOT) impl = Web3.to_checksum_address(raw[-20:]) print(impl) ```
Run eth_getCode against that address and you get the live logic. Now do it again next week and compare.
If the implementation address changes and no governance proposal preceded it, you have found a unilateral upgrade path. That is not a risk flag inside a template. That is the template.
I have watched three protocols in the last eighteen months upgrade their implementation contracts silently โ no forum post, no Snapshot vote, no timelock event. Each one was rated "well-governed" by at least one public research dashboard, because governance scores are computed from the existence of a governance contract rather than from its usage.
Core: The Parity Precedent, Revisited
I want to walk through the 2017 Parity multisig library incident because it is the cleanest illustration of blank-field thinking, and because the industry keeps relearning it.
The documentation described a wallet. The deployment logs described a library with an unprotected initializer. initWallet was callable by anyone. That meant anyone could call it, become the owner of the library contract, and then call kill on it. When that happened in November 2017, roughly 513,774 ETH became permanently inaccessible. Not stolen. Frozen. A different failure mode entirely, and a more instructive one.
The reason I broke that story forty-eight hours early was not that I had better sources. It was that I was reading the chain instead of the docs. The docs said "multi-signature." The chain said "single uninitialized entry point."
Here is the uncomfortable part. If you had run a modern diligence template against 2017 Parity, it would have scored well. Team: strong. Funding: strong. Code: audited. Narrative: dominant. The field for "initializer access control" did not exist, so nothing was blank. The template was perfectly filled and perfectly blind.
Every risk framework is a map of the risks its authors already knew about.
โ Root: The ESTP
That is why I now build my own field list from scratch for every protocol, and why the field list starts with four questions that no template I have seen asks:
- Who can call the upgrade function, and is there a timelock?
- Who can pause, freeze, or blacklist?
- Where does the price oracle come from, and what is its staleness window?
- What happens to user funds if the sequencer stops for six hours?
Question three is the one that gets skipped most often, and it is the one most likely to end your position. An oracle is a dependency, and dependencies are where "decentralized" stops being true. The most centralized component of most DeFi protocols is the line item that gets the least scrutiny.
I have written before that feed latency is DeFi's quietest lethal assumption. Watch a liquidation cascade on a fast-moving Sunday and you can see the staleness window open and close in real time. The template field for "oracle" usually reads "Chainlink." That is a vendor name, not an answer.
Core: Read the Distribution Before You Read the Thread
Token distribution is the field where N/A does the most damage, because distribution is the one thing you can verify independently without the team's cooperation.
You do not need a subscription. You need a block explorer and patience. Query the token contract's Transfer events from the deploy block, aggregate by address, filter out known exchange and contract addresses, and look at what remains.
In 2021, that method is how I caught the BAYC floor dump before it happened. I was not tracking the project's roadmap. I was tracking four hundred-plus ETH of NFTs moving out of wallets that had never sold before, clustered inside a single twenty-four-hour window. The floor dropped roughly thirty percent within days. The wallets did not know each other on-chain, but they moved in the same direction at the same time, which is the on-chain equivalent of a group chat.
Distribution analysis answers three questions that narrative analysis cannot:
- How much of the float is controlled by ten addresses?
- What fraction of those addresses are contracts that will unlock on a schedule?
- How many of the top holders received their tokens from the team wallet rather than from the market?
That last one is the tell. Not the size of the allocation โ the provenance. An address that bought its position is a different animal from an address that was seeded from the deployer. One has a cost basis. The other has an incentive to exit at any price above zero.
โ Root: The ESTP
Core: The ETF Flow Asymmetry
Zoom out, because the same blank-field problem operates at the macro layer, just with better data.
After the spot Bitcoin ETFs launched in the US in January 2024, I built a dashboard tracking net creations and redemptions across the major issuers. Within three weeks a pattern appeared that the headline numbers hid: strong US session inflows, consistent net outflows during Asian trading hours. Every morning the tape looked green. The twenty-four-hour net was not.
The US session was buying what Asia had already sold, and the press was reporting only the buying.
I published that asymmetry as a contrarian correction call. It was not a heroic forecast โ it was arithmetic that nobody had bothered to sum because the daily headline number came from a single regional window. I have audited settlement feeds; I know what a truncated reporting window looks like, and this was one.
The field that was blank here was not on-chain at all. It was temporal. Nobody had defined "the day." So the market defaulted to the window that produced the most interesting number.
This is the macro-micro bridge that most analysts skip. Institutional flow is not a number. It is a number with a timestamp and a timezone. Strip the timestamp and you have a narrative. Keep it and you have a signal.
Contrarian: Missing Data Is Not a Reason to Walk Away
Here is where I part company with the risk-committee instinct.
Blank fields do not automatically mean scam. A protocol with no token yet has no tokenomics. A protocol pre-launch has no TVL, no DAU, no retention. Filling those fields with guesses would be worse than leaving them empty โ and the honest move is to leave them empty.
But there is a difference between structurally absent data and conveniently absent data. Structurally absent: the thing does not exist yet. Conveniently absent: the thing exists, and the party that controls disclosure has chosen not to show it. Vesting schedules exist from the day the token is minted. If a project claims the schedule is "not finalized" six months after launch, the field is not blank because the answer is unknown. It is blank because the answer is bad.
The deeper contrarian point is that the industry has developed a defense mechanism against this. I call it coverage theater โ the production of comprehensive-looking research that has never once been wrong about anything specific. Sixty fields, zero predictions. Nine categories, no falsifiable claim. An output that cannot be falsified cannot be useful, no matter how neat the table.
A diligence report with no falsifiable claim is a brochure with a methodology section.
And notice who coverage theater serves. Not the reader โ the reader gets reassurance, which feels like information. It serves the producer of the report, who can never be embarrassed by a blank field because every field is blank, and the blanks are styled as rigor.
Coverage theater is not unique to layer-2 research, but layer-2 research perfected it. Every chain comparison template scores throughput, finality, and proof system โ and none of them score the only variable that has actually decided the category: which team shipped a one-command deployer first. The proof system is a footnote. The developer relations calendar is the product.
There is a version of this in every category. Bitcoin's blockspace is a Rolls-Royce; watching inscription metadata fill block after block is watching someone haul gravel in one. The market priced the gravel, not the car.
The 2022 FTX collapse was the largest coverage-theater failure of the decade. Alameda's balance sheet was not hidden from everyone. It was known, in fragments, to anyone who connected the exchange token's function to the market maker's collateral. The gap between what the industry knew and what the industry published was roughly eight billion dollars wide, and it was filled with structured research that read "N/A" in the only field that mattered: where are customer funds held, and are they segregated.
I have walked through that collapse from the reporter's side. Twelve hours of lead time on a regulatory action is not a victory. It is a symptom of how long it takes the published record to catch up to the actual one.
Cheetah.
Takeaway: What to Watch
Watch verification status. Watch the EIP-1967 implementation slot. Watch top-10 holder provenance, and watch when the unlock schedule was written rather than announced. Watch the oracle's staleness parameter โ that number will matter more than any roadmap in the next twelve months. None of these are exotic. All of them are free. All of them are usually blank.
Which raises the question I keep coming back to: in a market where every participant has the same public data, how is it that the most valuable field in every research template is still the one nobody populates?
Answer that, and you have the edge. Leave it blank, and you have a brochure.
โ Root: The ESTP