The validation returned zero information points. Eleven milliseconds later, the downstream scorer assigned the asset a risk grade of "low." Both events were written to the same log file. No exception was raised.
I have read that log file four times. It is the most expensive document I have handled in this industry โ not for what it cost to produce, but for what it would have cost to believe. The pipeline behaved exactly as specified. The schema held twelve fields. The extraction stage returned eleven empty strings and one null. The analysis stage, instructed never to leave a field blank, populated all twelve with prose fluent enough that a human reviewer approved the output in under ninety seconds.
No exploit was involved. No key was compromised. Nothing was drained. The eventual loss was the product of a formatting decision, and formatting decisions are not covered by insurance.
Automated research desks became standard infrastructure during the last cycle. By late 2025 most mid-tier funds, two exchanges I will not name, and a substantial fraction of "independent" research accounts ran agentic pipelines: ingest a link, decompose the text into atomic claims, emit a scored report. The architecture is uniform. Stage one extracts information points โ atomic factual statements, each tagged with a source position. Stage two derives conclusions under a hard constraint: every conclusion must cite the information point that supports it.
The constraint is sound. It is also, under exactly one condition, unsatisfiable. When stage one returns an empty set, stage two has nothing legal to cite. It can refuse, or it can violate its own constraint. There is no third option, and the vendors who sell these systems have priced the second one as the default.
The bear market changed the question being asked. In 2021 readers wanted to know which protocol would appreciate. Now they want to know whether the thing they hold will still exist in nine months. That question is answered by absence at least as often as by presence: an auditor nobody can verify, an unlock schedule that was never published, a treasury address with no outflow history. Absence is now load-bearing information, and the systems built to process presence have no representation for it.
A null is not a zero, and every risk dashboard I have audited conflates the two. In the placeholder output I reviewed, six risk categories returned "N/A." The composite grade returned "low." No step in the pipeline was malicious. The arithmetic averaged over an empty observation set and returned the initialization value, which is zero, which renders as green.
The reader of that dashboard does not see "unassessed." The reader sees "safe," because the label is generated by a color function and the color function has two states.
Ninety seconds is not an anomaly; it is the designed review time. The reviewer's task was defined as verifying that the output conformed to the schema, and it did. Schema validation is not content validation, and the industry has been treating them as synonyms since it started shipping JSON. Twelve fields were present. Twelve fields were populated. Nothing in the validation layer was capable of asking whether any of them referred to an observable fact.
This is not a new class of error. It is the oldest one in the discipline, wearing a different interface. In early 2018 I spent four months reverse-engineering the EtherDelta order-matching contracts before the migration. Fourteen logical flaws went into a public repository. The most instructive was an integer underflow in the matching engine: a subtraction that wrapped, producing a value the contract then accepted as a legitimate balance. The bug was not that the number was wrong. The bug was that an absent quantity had been coerced into a present one. The empty template is that same defect at a higher layer of abstraction. At the machine layer it wraps around; at the semantic layer it hallucinates. Both manufacture a number where none existed, and both pass their own unit tests. The ledger does not lie, it only waits to be read โ but the reader has to be able to distinguish a zero from a blank.
Language models are trained to be helpful, and helpfulness is a structural bias toward output. A refusal scores as a failure in every evaluation harness I have seen. Stage two therefore optimizes for the modal sentence, and in this industry the modal sentence is the marketing copy. Ask a model to characterize an invariant nobody has audited and the highest-probability completion is "battle-tested," because that is the phrase the corpus contains. The corpus was written by the people selling the thing.
I know what the alternative looks like because I published it. During DeFi Summer I spent three weeks inside Curve's StableSwap invariant, ignoring the TVL chart everyone else was reading. There is a precision error in the add_liquidity path that becomes exploitable under sufficient volatility โ roughly $2 million of exposure at the time of writing. I published the post-mortem against the prevailing narrative and absorbed the backlash. The development team patched. What made that document worth reading was not its confidence. It was that every claim was falsifiable, and the falsification arrived inside three weeks. A generated report asserting the invariant was battle-tested would have been unfalsifiable, and unfalsifiable claims were the reserve currency of the last cycle.
Terra is the same lesson at scale. I spent six months in a Berlin apartment building a simulation of the stability mechanism, and the collapse arrived three weeks after I published the critique of the incentive model โ $40 billion, priced at zero by people reading a dashboard that said "ecosystem growth." Note what the simulation did not do. It did not fill missing parameters with plausible values. Where I lacked a parameter, I ran the model across a range and reported the range. The empty template did the opposite: it reported a point estimate over an empty range.
The provenance requirement exists to make conclusions attackable at the root. When the citation is stripped, the claim becomes unfalsifiable, and unfalsifiable output is indistinguishable from output that was never generated. In the file I reviewed, those two states were rendered identically: same twelve fields, same typography, same calibrated confidence language. A document containing no claims had been formatted as a document containing claims. The same failure shows up at the governance layer. A custody diagram that lists "2-of-3 multisignature" without naming the keyholders is an empty template wearing a security model; I have seen exactly that diagram used to sell a self-custody narrative in which one key sat inside an institutional custodian.
The fix is Kleene three-valued logic, and almost no risk dashboard implements it. In two-valued logic, "no evidence of risk" collapses to "no risk." In three-valued logic, UNKNOWN propagates: UNKNOWN AND TRUE is UNKNOWN, and no sequence of operations yields TRUE from UNKNOWN. An auditor works in three-valued logic by professional obligation โ an unexamined control is a finding, not a pass. A dashboard that cannot represent UNKNOWN is not a dashboard. It is a marketing surface with a database behind it.
The vendor economics push in the same direction. Research pipelines are sold and renewed on coverage โ assets processed, reports emitted, latency โ and coverage is maximized by never refusing. A refusal is invisible in a dashboard that counts outputs and catastrophic in a dashboard that counts positions. Until refusal appears in the contract, the pipeline will keep manufacturing the modal sentence, and the client will keep buying it, because the client is also measured on coverage.
I ran into the same distinction at the indexer level. An address with no transaction history has a balance of zero, and zero is a valid balance. "No data" and "zero" are different states in every RPC I have ever tested, and they are collapsed into the same rendered digit by almost every interface built on top of them. My OpenSea work in late 2021 depended entirely on keeping them separate: 47 wallets selling floor assets seconds before artist announcements, roughly $12 million accumulated, every link in the graph traceable to a transaction hash. The heuristic was published alongside the graph, which is why it survived the accusations of FUD. A cluster analysis without a published heuristic is an empty template with a scatter plot.
In a market where capital is leaving rather than arriving, these artifacts are load-bearing. A Layer 2 operator watching proving costs needs a per-batch number and an amortization curve against transaction count. Proving cost per batch divided by transactions per batch is the only figure that determines whether an operator's margin exists, and it cannot be computed from a field that reads "N/A." A dashboard that returns "N/A" for proving cost tells the operator nothing about whether the sequencer is bleeding, and the operator reads "N/A" as "no finding." The same shape appears in digital collectibles. A sales-volume metric on an asset with no functioning secondary market describes a transaction while concealing the absence of a market. The number is real. The market is the null.
The reflex is to reject the automation outright โ to insist that only a human with a text editor can be trusted with a contract. That position is self-serving for someone in my seat, and it is empirically weak. I have reviewed human research with the identical defect: a junior analyst pasted a competitor's TVL into a comparables table, and it survived two quarters of circulation because nobody re-derived it. The human failure is strictly worse, because it leaves no log.
What the coverage argument gets right is scale. You cannot hand-audit the long tail. There are more deployed contracts than there are people competent to read them, and the gap widens every quarter. The pipeline that returned zero information points was, in that specific moment, the most honest artifact in the entire episode. It was the only component that declined to invent. Stage one's silence was correct. The failure was that stage two had no channel through which to transmit it.
Teams that instrument refusal will out-survive teams that instrument coverage. In a bear market the cost of a false "low" exceeds the cost of an honest "unknown" by orders of magnitude, because the first is already priced into a position and the second is not.
There is exactly one legitimate use for an empty template: as a control. Run it through your scoring layer once a quarter and confirm that the output is an error, not a grade. I have started doing this with every pipeline I inherit, and the failure rate on first pass is above 50%. That number is not a comment on the vendors. It is a comment on how rarely anyone inspects the state in which a system has nothing to say. The ledger does not lie, it only waits to be read, and the first thing to read is whether anything was written at all.
Assert non-empty. Set a floor on information-point count. Validate the domain tag against an enum. Return an error code above the analysis layer and stop the pipeline there, rather than letting it negotiate with its own constraints. Log refusals as a first-class metric and report them to the client. The ledger does not lie, it only waits to be read โ and an empty ledger is not a zero balance. A page formatted to look like an answer is the most dangerous document in the file, because it is the only one that will never be re-opened.