A zero-knowledge circuit with zero constraints is perfectly sound. It will accept every witness you hand it, including the false ones.
In 2024, while benchmarking zkSync Era's STARK-based prover against Polygon's CDK, I watched a constraint optimizer collapse a native-asset transfer circuit down toward nothing. Proving time improved 15%. For about forty minutes, the circuit proved everything and nothing at all. We caught it because the verifier rejected a valid input, not because a proof was wrong. Soundness fails silently. ZK-circuits are compressing the future; they are also extraordinarily good at compressing a bug into the empty set.
Last week I opened a research report with the same shape.
Nine dimensions. Roughly forty tables. Technical architecture, tokenomics, market structure, ecosystem position, regulatory posture, team and governance, risk matrix, narrative expectation, supply-chain transmission. Every substantive cell read N/A. Not "unknown." Not "disputed." Not "insufficient public data, see note 4." N/A โ the null value, formatted, aligned, and rendered in the same typeface as a finding.
The report arrived with a disclaimer, a star-rating table, and a recommendation to re-run the source material. It was, in the strictest sense, complete.
Context
The artifact deserves a name before it deserves an argument: a null-complete report. Schema-valid, information-empty.
The pipeline that produced it is standard practice now. Stage one deconstructs a source into a list of discrete information points. Stage two maps those points across nine analytical dimensions and returns a structured verdict. The design is sound. It forces coverage, blocks cherry-picking, and makes outputs comparable across assets โ the same reason equity research converged on a shared ten-page format decades ago.
This run, stage one returned an empty list. No title, no claims, no named protocol, no timestamp. Stage two handled it correctly and honestly: it declared "insufficient information, cannot evaluate" across every dimension and recommended re-running the input. That is the right behavior, and I want to be precise about what follows. The failure here is not hallucination. The report never invented a fact.
The failure is architectural. Stage two returned a schema-complete document on a null input, and a schema-complete document is indistinguishable from an evaluated one at the point of consumption. Every field was present. Every field was empty. The object had the shape of knowledge and the mass of nothing.
Now scale it. This is not one bad report. It is the dominant production function of crypto research in the current cycle. Standardized frameworks are cheap to execute and cheaper to template. Under abundant capital, the demand side prices coverage โ assets reviewed, dimensions covered, pages delivered โ not accuracy. The underlying dataset has not grown; only the number of documents describing it has. Layer 2 fragmentation already ran this experiment for us: dozens of chains competing for a user base that has not materially grown, liquidity sliced thinner with every launch. The research layer is repeating the pattern with less visibility. Dozens of shops, nine identical dimensions, one thin underlying dataset, differentiated only by the PDF template.
And note the tell that matters most. The report was written about no named project. It is process without a product. Someone is shipping the pipeline.
Checklist culture is not new. Crypto imported the diligence matrix from venture capital somewhere around 2017, when every fund needed a comparable artifact for its investment committee. What is new is the amplification. By 2026, template execution is automated end to end โ extract, map, render โ and the marginal cost of a schema-complete report has fallen close to zero. Falling cost is normally a gift. Here it means the market is flooded with outputs whose production never required a reading of the code, the chain, or the filing. Formatting is a credibility transfer function: N/A inside a professional report structure inherits the credibility of the structure, and the structure was never audited.
Core
Every analytical framework is a function. Write it as Report = f(input). The soundness property we want is explicit: if the input set is empty, f must revert. Not return null. Revert.
Solidity developers learn this the hard way. A view function that hits a failed precondition and returns the zero value instead of reverting is a bug, because every downstream caller that does not explicitly check will treat zero as data. Zero is a valid uint. Zero is a valid price. Zero is a valid balance. The EVM cannot tell you the difference between "the balance is zero" and "I failed to read the balance." Only the caller can, and only if the caller was told.
The report I opened never reverts. It returns a fully populated struct of zeros. Technical innovation: N/A. Security assumptions: N/A. Supply model: N/A. Team capability: N/A. Risk matrix: six categories, six N/A rows, aggregate rating "cannot be assessed." Each one is a swallowed exception wearing the costume of a considered answer.
Code does not lie, but it can be misled. A report can do something worse. It can tell the truth inside a schema that implies a measurement occurred.
Look at the ratings. The report assigns stars โ technical value, investment value, timeliness, reference value โ one star out of five, each annotated "no information available for assessment."
A one-star rating is not the absence of a measurement. It is a measurement. A five-point scale asserts that five points exist and that the subject was located on it. Null cannot be located on a five-point scale. The correct rendering of "no information" is an empty cell with a reason code and a provenance pointer. The moment you place a null on an ordinal scale, you have fabricated a data point, and the fabrication is invisible, because the scale renders cleanly.
This is the same error class as a DeFi dashboard showing APY = 0 for a pool whose contract reverted. The number displays. The number is wrong. The number is wrong in the direction of confidence.
There is a difference between a null that carries information and a null that carries nothing. "Team identity undisclosed" is a structured null with a claim attached; somebody checked, and the check failed. "On-chain TVL: N/A" is not a null at all when the contracts are deployed and public. A blockchain is the most queryable object in finance. If a field labeled on-chain TVL returns N/A, the correct interpretation is not "unknown." It is "the analyst did not query." That distinction is the entire value of the report, and the report declines to make it.
There is also a missing tenth dimension: provenance. Watch what the schema never asks. Where did the input come from? Who paid for the analysis? What does the funding source gain from a favorable verdict? What is the latency between the event and the assessment โ days, or minutes? Which claims are first-hand, and which are a paraphrase of a paraphrase?
None of those questions have a field. The framework asks whether the oracle is decentralized and never asks whether the analyst is. Trust is a legacy variable. DeFi stopped pretending otherwise years ago โ price feed latency is the whole game, and the industry's answer is a permissioned committee of staked nodes with slashing conditions and a reputation layer. That is decentralization by contract, enforced by incentives, not cryptography. Accept it or not, it means feed security is a function of who sits on the committee and what they can lose. The identical audit applies to a research report. Nine dimensions on the protocol. Zero on the person writing them. I have raised this gap twice in public work and been told both times that it is out of scope. Out of scope of what? The scope was chosen by the same people who chose the dimensions.
Latency is the missing field nobody notices. A nine-dimension report has no column for time. In a market where a protocol can be upgraded by a single multisig transaction inside one block, a diligence document dated to the week is already historical fiction. The report I opened carried no timestamp at all, which means it cannot be wrong โ and an artifact that cannot be wrong cannot be useful.
I ran a version of this post-mortem in 2025. Three cross-chain bridge exploits inside one regulatory window, roughly $400 million in combined losses. The contracts were not the failure. Signature verification at the consensus layer was not the failure either, in the narrow sense that it verified signatures and the signers had signed. The failure was convergence: three unrelated bridges had independently adopted the same operational pattern, a small multisig holding upgrade authority with no separation between the key that approves a state transition and the key that can rewrite the verifier.
Our checklist was far less elegant than nine dimensions. It was one question, asked in three places: who can change the code, and what do they need in hand to do it? The finding lived in the gap between the protocol and the humans operating it, nowhere near the rows a standard template would have scored. A nine-dimension report would have marked all three bridges green on security assumptions and N/A everywhere else, and the N/A would have read as "no known issues."
Why does the null-complete artifact survive? Because at the point of consumption, almost nobody filters on information content. Consumers filter on presence. A field exists; therefore it was considered; therefore it was checked. Coverage looks like diligence. Diligence looks like risk reduction. Under a bull market, the cheap report drives out the expensive one: the two are visually identical in a deck, nine dimensions and forty tables apiece, and only one of them consumed forty hours.
I know what forty hours buys. In 2020 I spent them on the bZx v3 contracts and produced exactly one finding, an integer overflow in the flash loan repayment path that would have allowed an attacker to drain liquidity pools. One line of code, reported upstream before any exploit. Under any nine-dimension template, bZx v3 scores clean. Green on technical innovation. Green on security assumptions. The overflow lives in the whitespace between rows.
Now the aggregation failure, which is the part that actually worries me. When N analysts run the same schema, their outputs correlate. Correlated output reads as consensus. Consensus reads as priceable information. But correlated N/A is not consensus. It is variance collapse. You have not collected N independent observations of a protocol. You have collected N renderings of one absence, in the same format, and mistaken their agreement for evidence.
In 2022, reverse-engineering early optimistic rollup fraud proofs, the signal came from divergence: where Arbitrum's challenge design split from Optimism's, and what that split implied about calldata compression and the true cost of an institutional-sized transfer. The divergence was the finding. A standardized template is engineered to erase divergence before anyone reads it.
This stops being an aesthetic complaint the moment agents start consuming reports. I am building incentive models for agent-to-agent transactions on L2, pricing micro-payments for computation and validation so autonomous agents can buy storage and proofs with no human in the loop. An agent reading a report with present-but-null fields cannot distinguish "no data" from "neutral data" unless the schema declares nullability per field, with provenance and a confidence bound. If it cannot make that distinction, it pays for validation and receives vacuous truth. Vacuous truth is the cheapest thing to produce and the hardest to detect, which makes it the ideal product for a spam economy. The proof system that accepts every witness is the attack vector. So is the research product that validates every protocol.
The fix is not more dimensions. It is a schema-level revert: empty input, loud failure, reason code, compute refunded.
Contrarian
Here is the part that should not be flattened into a complaint. The empty report is, in one narrow sense, the most honest artifact crypto produced this quarter. It refused to hallucinate. That is rarer than it should be. Every filled cell in a bull-market research deck is a liability, a claim somebody will eventually trade against with real capital. The N/A report has a fabrication surface of zero, and I can measure a void. I cannot measure confidence. Give me the null report over a fully populated one with no audit log, every time. I would rather fund a report with a documented negative result than a report with a perfect scorecard and no evidence chain.
But the honesty hides the real problem. The blind spot is not the empty cells. The blind spot is the field list. Whoever designs the checklist chooses where the blind spots go. A schema with nine dimensions and no dimension for who funded the work, or what the funder gains, is not neutral. It is a specification. And template compliance is a pass/fail test an adversary can study offline. If I know your nine dimensions, I know which eight to make legible and which one to bury the exploit in.
The governance dimension is the clearest tell. It asks about vote participation, top-10 holder concentration, and proposal quality. It never asks whether the governing entity has legal personality at all. When the wrapper fails, the question is not turnout. The question is who is holding the liability, and in most DAO structures the answer is everyone with a token and no corporate veil. That question has never appeared in a nine-dimension template, because templates are assembled by people who do not expect to be defendants.
Takeaway
Prediction for the next cycle: the differentiator will not be more dimensions. It will be negative space. The research products that survive will publish what they could not determine โ declared nulls, per-claim provenance, confidence intervals on every assertion โ because agents will not pay for less and institutions will not sign off on less.
If your analysis function returns a complete nine-dimension report on an empty input, ask what it returns on a corrupted one.
That is not a rhetorical question. Somebody is already running it.