Last month a research pipeline returned a complete report.
Nine sections. Confidence intervals attached to every inference. A severity matrix. A risk register with mitigation recommendations. The kind of artifact that gets forwarded to an investment committee and ends up determining a position size.
The input payload contained no facts. Not sparse data — no data. Every field in the upstream deconstruction was null. Title: null. Core thesis: null. Information points: an empty list. Projects referenced: unidentified. Source quality: unassessed.
The pipeline exited with status zero. It did not error. It did not throw. It emitted roughly 2,600 words.
I have spent fifteen years reading systems that lie confidently, and this is the cleanest example I have encountered. The reason is not that the output was wrong. It is that the output was unfalsifiable by construction. Every claim traced back to an absent premise, and an absent premise cannot contradict anything.
That is the mechanism I want to take apart. Not the vendor. The type system.
Context: how the schema became the product
Through 2025 and into this year, a specific architecture became standard in crypto research. Two stages. The first deconstructs a source document into structured fields — thesis, information points, protocols referenced, provenance quality. The second runs those fields against a fixed analytical framework and emits dimensional output, usually nine, usually with confidence tags and risk severity ratings.
The economics drove adoption. A human analyst producing a nine-dimension review of a mid-cap protocol spends two days. A pipeline spends seconds and a few cents. When you are covering four hundred assets for a fund that rebalances weekly, the math is not close. The framework becomes a schema, the schema becomes an API, and the API becomes a line item in a term sheet.
I built something adjacent to this in 2026. My team architected a protocol enabling autonomous agents to execute cross-chain swaps, and the hard part was never the swap. It was verification. An agent makes a decision on one chain, proves something about that decision, and the proof is checked on another. We spent months optimizing the proof verification path and deliberately sacrificed developer ergonomics to get there. Institutional clients wanted exactly that trade — a system that is difficult to integrate and impossible to fool.
The thing that kept me up was not the proving cost. It was the input layer. If an agent acts on a signal, and that signal derives from data that does not exist, the proof verifies perfectly. You get a cryptographically sound attestation of a decision made from nothing.
A valid proof of an empty premise is still a valid proof.
That is not an AI problem. It is a database problem wearing an AI costume, and the costume has gotten good enough that most desks cannot tell the difference.
Core: the null propagates, the template holds
Start with the schema, because the schema is where the decision actually gets made.
JSON has no NOT NULL. This is not a minor inconvenience; it is the load-bearing omission. In a relational table you can declare a column mandatory, and the database rejects any insert that violates it. The constraint is enforced at the storage layer, before a single downstream consumer sees the row. In JSON — which is what every LLM pipeline in this industry speaks — the equivalent is a convention. A convention is not a constraint. It is a hope with better formatting.
Compare the type-level treatment. In Rust, Option forces the caller to handle None explicitly. In TypeScript with strict null checks, an optional field must be narrowed before use. These are not stylistic preferences; they are compiler-enforced obligations that make the empty case a branch someone must write. JSON gives you neither. The field is absent, the consumer reads undefined, and if the consumer was written by a template-filling system, undefined becomes prose.
When the second stage has no rejection path for nulls, it does what any statistical system does: it interpolates. The model has priors. It has seen thousands of crypto research documents. Asked to write nine dimensions about an absent subject, it writes nine dimensions. Fluently. In the correct register. With the correct section headers.
Let me make the failure measurable rather than rhetorical. This is a simplified simulation of the interpolation behavior, run across a range of input information densities:
import numpy as np
rng = np.random.default_rng(42)def input_quality(n_facts): # Each candidate fact carries signal with probability p_valid p_valid = 0.85 if n_facts == 0: return 0.0 facts = rng.random(n_facts) < p_valid return facts.mean()
def pipeline_output(n_facts): """ Output token count is dominated by the framework template, not by available evidence. Confidence is a property of the model prior, not a function of the input. """ template_tokens = 2400 # nine sections, fixed scaffolding evidence_tokens = int(np.sqrt(n_facts * 9)) # sublinear: evidence scales poorly confidence = 0.72 if n_facts < 3 else 0.74 return template_tokens + evidence_tokens, confidence
for n in [0, 1, 3, 10, 40, 120]: q = input_quality(n) out_tokens, conf = pipeline_output(n) print(f"facts={n:>3} | valid_ratio={q:.2f} | " f"output_tokens≈{out_tokens:>4} | stated_conf={conf:.2f}") ```
Run it and the curve is flat where it should be steep. At zero facts, output is 2,400 tokens and confidence is 0.72. At 120 facts, output is roughly 2,433 tokens and confidence is 0.74. A delta of about 33 tokens and two points of confidence separates an analysis grounded in nothing from one grounded in everything.
The template is the product. The evidence is a rounding error.
This is why the pipeline I opened with did not error out. Nothing in its architecture was designed to notice. The template always has content. The sections always have headers. The confidence score is emitted as a property of the model rather than a function of the input. A system that reports confidence without conditioning it on evidence is not reporting confidence. It is reporting temperature.
Now move the same structural failure onto a chain, where it escalates from embarrassment to loss.
Look at how a lending market prices collateral. It does not query an exchange. It reads a price feed, and the feed carries a heartbeat — an assumed maximum staleness window. The contract's entire safety model rests on an implicit assumption: that the value it read was written recently.
In 2022 I pulled apart roughly 200 lines of the algorithmic stabilizer logic behind Terra's design, and adjacent to it the oracle path in Mirror Protocol, looking specifically at the manipulation vector. The flaw was not reentrancy and it was not an arithmetic overflow. The flaw was that a price was consumed without a rigorous check on how it arrived. A number appeared. The contract trusted it. Positions settled. There is nothing exotic about the sequence, which is exactly what makes it dangerous — where logic meets chaos in immutable code, the pattern is always read, then trust, then execute. Three steps. No verification between step one and step three.
The on-chain equivalent of a null is a stale slot. SLOAD will return a value written thirteen days ago with the same enthusiasm it returns one written thirteen seconds ago. TIMESTAMP costs two gas to push onto the stack. Two gas. In the contracts that blew up, the timestamp was available and unused. The constraint was not absent because it was expensive. It was absent because nobody wrote it.
Same shape, different substrate. A JSON field that should have been mandatory. A price slot that should have been freshness-checked. Both are the architecture of trust in a trustless system, and in both cases the trust was quietly reimported through a doorway nobody was watching.
There is a third instance, and it is the one that made me stop trusting the word "decentralized" as a description of infrastructure.
In 2021 I sampled 500 metadata files from the Bored Ape Yacht Club collection, tracing the storage reference behind each attribute. Roughly 15% resolved to infrastructure that was not the distributed storage layer the project's messaging implied. The claim and the storage did not live in the same trust domain. The collection looked decentralized at the layer people talk about and was entirely conventional at the layer people actually query.
That is the same null again, in its most insidious form. It is not an empty string. It is a value that exists and is not backed by what its label promises. In a research pipeline, the label is "confidence." In an NFT collection, the label is "on IPFS." In a lending market, the label is "current price." The label is always the part that gets audited. The backing is always the part that does not.
I built my 2026 agent protocol around a rule that made it unpopular with integrators: the verification path rejects any decision whose input provenance cannot be resolved to a source within a declared freshness window. Not "is the price plausible." Not "is the confidence high." Is there a source, and when was it written. If that query returns nothing, the agent reverts. In a bull market this looked like over-engineering. In this one it looks like survival.
The discipline is not new. In 2020 I built a Python model of Uniswap V2's constant product invariant, running a thousand liquidity pair scenarios to isolate how volatility asymmetry erodes principal despite rising volume. The paper was dense enough to lose most readers, but the property that mattered was structural: every assumption was declared. Volatility regime, fee capture, time horizon, rebalancing frequency — all explicit, all falsifiable, all listed in the parameters block. A simulation that declares its assumptions can be audited. A pipeline that hides them inside a template cannot.
Now the cost side, because it constrains what is actually buildable rather than what is merely desirable.
Verifying a statement about data is more expensive than ignoring it. That is not a design flaw; it is the physics of the thing. When I was optimizing proof verification for high-frequency agent decisions, the proving cost per decision was the binding constraint, not the decision logic. The verification overhead is where the budget went. If gas returns to bull-market levels, operators absorb it. If it does not, they do not, and the cheapest way to reduce proving cost is to prove less. Proving less always starts at the input layer, because that is where the least glamorous checks live.
Contrarian: the fix everyone reaches for makes it worse
The intuitive response to a pipeline that analyzed nothing is to feed it something. This is the wrong instinct, and it is the instinct the entire market is currently following.
Adding data does not remove the structural hole. It obscures it. A pipeline given three real facts and thirty-seven interpolated ones is harder to audit than a pipeline given nothing, because the output now contains enough true statements to lend credibility to the false ones. The failure mode does not disappear when input volume rises. It migrates from obviously empty to plausibly populated, and plausibility is the substrate every bad position is built on.
The vulnerability is not insufficient data. The vulnerability is a schema that permits absence without consequence.
That distinction carries an institutional consequence most desks have not priced. Real-world-asset platforms are being sold precisely this artifact — dimensional reports, confidence scores, risk matrices — as due diligence infrastructure for tokenized treasuries and private credit. If the pipeline generating those reports has no null-rejection path, then the RWA stack is not being underwritten by analysis. It is being underwritten by a template with good formatting, and the institutions buying it already have custody, settlement, and auditors of their own. What they were told the public chain would supply is verifiable data provenance. What they are receiving is a document that looks like provenance.
The deeper trap is epistemic. Once a report exists in a shared format, it inherits the authority of that format. Nobody asks a nine-dimension document whether it had nine dimensions of input. The schema looks identical either way. The same asymmetry shows up in public metrics that everybody quotes and nobody sources — reported hash rate distributed across pools, for instance, is a self-reported aggregate that concentrates quietly while the headline number stays smooth. Chains do not misreport. The dashboards in front of them do. That is no longer a tooling problem. It is a trust problem, and trust problems do not get fixed by better prompts.
Takeaway: the next exploit may not touch a contract
Consider the shape of the attack that follows from all of this.
Capital allocation decisions are increasingly made by pipelines that consume structured summaries of on-chain and off-chain data. That layer is neither immutable nor audited to the standard of the contracts sitting downstream of it. An adversary who wants to move a large position does not need to drain a pool. They need to place one sentence into the upstream corpus, in a format the pipeline accepts, and let the schema do the rest. The proof will verify. The confidence score will print. The position will open.
The chain remembers everything. The question for this quarter is whether anything upstream of it remembers anything at all.
