The template has nine boxes. I keep it in a plain text file, because plain text does not flatter me. Technology, token economics, market, ecosystem position, regulatory posture, team and governance, risk, narrative, and the transmission path through the supply chain. Nine questions. Four years of iteration. Most of what I know about reading this industry is compressed into those nine lines.
Last month I fed it nothing. No title. No source. No timestamp. No ticker. No numbers. A payload of zero. One tool returned a single sentence: input insufficient, here is what I need. Another returned eleven pages of confident, well-structured, footnoted-sounding prose — technology positioning, unlock risk, Howey analysis, a competitive moat. All of it invented. Every line of it fluent. Not one character of it traceable to anything that existed.
That second document is the most dangerous artifact this industry produces. Not the scam token. Not the rug pull. The plausible report.
I have spent twenty-four years watching protocols promise and fail, and I have learned that the failure mode is rarely dramatic. It is administrative. It arrives as a well-formatted PDF with a nine-box structure and no inputs behind it, and someone allocates capital against it, and six months later nobody can reconstruct where the number came from. Silence is the loudest audit. An empty return is not a failure of the analyst. It is the finding.
Let me be precise about what those nine boxes are for, because the template is not a personality trait, it is a control system. Technology positioning decides whether you are looking at a settlement layer, a data availability layer, or an application with a token stapled to it — and those three things have completely different failure modes. Token economics asks who gets paid, when, and out of whose pocket. Market asks whether the information is already priced. Ecosystem position asks what breaks upstream if this breaks. Regulatory posture asks which jurisdiction's enforcement theory you are actually exposed to, not which one the press release mentions. Team and governance asks whether the multisig has three keys held by two people. Risk asks what the six ways to zero are. Narrative asks what the crowd currently believes and how far that belief has drifted from the mechanism. Transmission asks which adjacent protocols inherit the damage.
That framework did not come from a course. It came from three months in 2017 auditing the Ethereum Classic fork's immutable ledger mechanics, submitting twelve technical critiques to GitHub, and slowly realizing that the hardest question was never in the code. The code held. The governance philosophy around it did not. Every box in my template since then has been an attempt to catch the thing that lives outside the diff.
Here is the mechanism most people miss. N/A is a value, not an absence. When a field returns "not available," it is not a blank waiting to be filled by inference. It is a reading. It says: the information required to answer this question was not supplied. That reading is data. It tells you something about the source — that it has no timestamp, that it cites no denominator, that it names no counterparty — and those facts about the source are often more diagnostic than the content itself.
The template's minimum viable input list is deliberately brutal. Priority zero: title, source, and publication time. Three to eight discrete information points, each with a quotable fragment so every downstream conclusion can be traced back to a specific sentence. The project or protocol name, including ticker. A one-line thesis plus the author's stated position — long, short, or neutral. Priority one: the actual numbers. Raise size, TVL, APR composition, unlock percentage, throughput. Priority two: the link, so the claim can be cross-checked rather than trusted.
Four fields. That is the bar. Give me a timestamp, a ticker, a handful of quoted facts, and a stated bias, and I can work. Give me a polished narrative without them and I can only perform.
And performance is what this cycle pays for. We are in a bull market. I do not need to check the chart to know that; I need only look at how many nine-box reports are being produced by people who have never once written "insufficient." The euphoria is not the dangerous part. The dangerous part is that euphoria makes plausibility fungible with accuracy. A confident structural analysis and a rigorous one look identical from six feet away. Only one of them can be falsified.
That is the property I care about. Falsifiability. A report that says the project has a specific unlock cliff on a specific date at a specific valuation can be wrong, and being wrong is a feature — it can be checked. A report that says the project has "strong fundamentals and a robust ecosystem" cannot be wrong, because it cannot be tested. Unfalsifiable analysis is not analysis. It is decoration with a citation format.
The four value axes in the template — technical, investment, temporal, referential — are multiplicative, not additive. A technically excellent analysis of an expired event scores zero overall, because the temporal term is zero. A perfectly timed note based on a misread source scores near zero, because the referential term collapsed. Multiplicative scoring is unforgiving by design. It punishes the specific laziness that produces confident prose: the assumption that being timely is the same as being right, or that being technically sophisticated is the same as being relevant.
Of all the fields, the timestamp is the most underrated and the most frequently absent. This is not an accident. A missing timestamp is the single most reliable signature of recycled content. In a market that moves in nine-month narrative cycles, an eighteen-month-old funding announcement reposted without a date reads as fresh. The valuation looks cheap. The comparison set looks flattering. The reader has no way to know that the comparable round happened at a different point in the liquidity cycle, and that the gap between the two numbers is not a discount but a different regime entirely.
I have watched a family office almost allocate against a deck whose "recent" partnership announcement predated the partner's own restructuring by a full year. The document was not fraudulent. It was undated. The most expensive lie in this industry is usually an omission.
The second most expensive is a missing denominator. Almost every number in crypto is a ratio with an invisible bottom half. TVL is not a quantity of money; it is a quantity of money divided by a price, and when the price halves, the TVL halves without a single dollar leaving. An APR is not a return; it is a subsidy divided by a deposit base, and the moment the subsidy ends, the deposit base finds out what it actually was. When I audited a high-yield farming protocol in 2020 and found the reentrancy path, the vulnerability was almost the less interesting discovery. The more interesting one was that the advertised yield was a transfer from future depositors to current ones, dressed as a revenue share. Nobody asked for the denominator. The crash reveals the architecture — but only if you recorded the architecture before the crash.
The third is the counterparty. Who holds the keys. How many signers. What the unlock schedule does to the float in month seven rather than month seventy. In 2024, working with an Abu Dhabi family office on a ten-million-dollar initial allocation, the conversation that mattered was not about upside. It was about custody: who physically controls the keys, under what legal wrapper, with what recovery assumption if two of three signers become unavailable. That is an unglamorous box. It is also the box that decides whether the position survives an operational event.
Now the harder problem, and the one I have spent the last year on. We have, as an industry, become very good at proving who wrote something. Cryptographic signatures attach authorship to digital art, to datasets, to model outputs. I helped build an open-source standard for exactly that — signatures that distinguish human intent from generated output. It works. It is also insufficient, and the insufficiency is structural.
A signature proves provenance. It does not prove sufficiency. You can cryptographically attest that a human wrote an empty report. The signature will verify perfectly. The report will still contain nothing. We solved attribution and mistook it for verification, and in doing so we built a system that can certify the authenticity of a hallucination. That is a new failure mode, and it is worse than the old one, because it arrives with a checkmark.
The next layer has to attest to inputs, not just outputs. Not "who said this" but "what was available when they said it, and what did they claim to have checked." A declaration of the input set, signed and bound to the output, would make the empty report visible as empty. That is a solvable engineering problem and an unsolved incentive problem, because the honest declaration is the one that admits it had less to work with.
Which brings me to the test I actually use now, three lines long, before I read any number in this industry.
First: when was this true? If there is no timestamp, the number is not data. Second: what is the denominator? If the ratio has no visible bottom, the ratio is a mood. Third: who is the counterparty? If the answer is "the protocol," the counterparty is whoever holds the multisig, and you have not found them yet.
Three questions. Roughly fifteen seconds. They eliminate the majority of what crosses my desk, and they do it without requiring me to be smarter than the person who wrote the document. That is the point. Verification should not depend on superior insight. It should depend on a fixed standard that anyone can apply, including to me. Trust the protocol, not the pitch — and if I ever write a nine-box report without showing you the four inputs behind it, apply the standard to me first.
Here is where I have to be honest about the cost. Refusing to produce a report is expensive. The empty return does not get published. It does not get quoted. It does not get the family office meeting. The eleven-page fabrication gets the meeting, and by the time the mechanism asserts itself, the fabricator has moved to a different narrative and a different audience. In a bull market, the incentive gradient points almost entirely toward fluency. This is why the discipline has to be structural rather than moral. A person of good character will still fill in a blank when they are tired and the deadline is close. A template that returns N/A does not get tired.
And yet I want to test my own position, because a rule that cannot survive its counterargument is not a rule.
The pragmatist's objection is this: a system that refuses often is a system that is useless. If an analyst returns "insufficient input" on nine out of ten requests, the market will route around them, and routing around them means the ten requests get answered by someone with no threshold at all. Refusal that does not scale is not integrity. It is boutique.
The objection lands. Refusal is not a product. It is a checkpoint, and a checkpoint nobody can pass is a wall.
So the threshold has to be published, specific, and low enough to be achievable. Not "I need perfect information." Something closer to: a timestamp, a ticker, three quotable facts, and a stated bias. Any competent source can meet that bar in an afternoon. A source that cannot meet it is telling you something about itself that is more valuable than the analysis you were asking for. The refusal is not a verdict on the requester's character. It is a measurement of the input's density, and the measurement should be shown, with the missing fields listed by name, so the gap can be closed rather than merely noted.
That is the difference between a gate and a wall. A gate tells you which key it needs.
There is a second, subtler risk, and it is the one I watch for in my own work: refusal as identity. Once an analyst becomes known for saying "insufficient," the refusal starts to carry brand value, and a branded refusal is no longer a control — it is a performance of rigor. The test is simple. When the inputs arrive, does the analysis actually get produced, or does the threshold quietly move? If it moves, the rigor was theater. If it does not, you have a standard.
Standards are unglamorous and they compound. In two years, the blob capacity everyone is currently assuming will be there will meet a fee market that does not care about the roadmap, and the projects that survive that transition will be the ones whose analysts wrote down what was true on a specific date, with a denominator visible, and signed it. The rest will have eleven pages of fluent prose and no record of what they actually knew.
So here is the forward question I would put to anyone building analysis tools, human or machine. When your system receives nothing, what does it output? If the answer is a report, you have built a confidence machine, and confidence is the cheapest input in this market. If the answer is a list of the four things it needs, you have built an audit.
Code doesn't negotiate. It returns what the inputs justify, and nothing more. The report that refused to lie is the only one I can still defend six months later. Everything else was just well-formatted noise, and the noise is getting better every quarter.