The most useful number in my last diligence report was zero. Zero verified contracts. Zero repository commits. Zero named multisig signers. Zero audit scope. One hundred million dollars raised against that.
The project reached me as a link and a screenshot of a deck. No whitepaper, no documentation site, no token address, no legal entity, no named founder. The stated rationale for the silence was "stealth until TGE." I ran the checks anyway, because that is what I do, and every check returned null. The nulls were not the ragged inconsistency of an early team that simply has not published yet. They were consistent. Uniform. A structure that returns nothing is still a structure, and it has a shape.
A project that produces no verifiable artifacts is not an unknown quantity. It is a known quantity with a specific profile. The profile is: capital has been raised, delivery has not been contracted, and every piece of evidence that could create liability has been withheld. That is not a gap in the record. That is the record.
Bull markets do not invent fraud; they lower the cost of it. In the 2017 cycle the artifact was the whitepaper — worthless as engineering, but present, and therefore checkable against itself. We spent three years mocking those documents, correctly, and the market overcorrected. By 2021 the flex was "no roadmap." By 2026 the flex is "no docs at all." The industry took a valid critique of paper theater and inverted it into a credential for paper absence, which is a strictly worse epistemics.
The funding environment did the rest. Pre-token markets, points programs, perpetual listings on tokens that do not exist yet, and a class of allocator whose mandate is to be early rather than to be right. Capital now arrives before the artifact, sometimes years before, and the fee is earned at deployment of capital rather than at delivery of product. Once you internalize that incentive, the null target stops looking like an anomaly. It looks like the natural end state.
So I built a protocol for it. Not a vibe check — a sequence of falsifiable questions, each of which returns either an artifact or a null. The interesting result is not that some projects fail all of them. It is how much you learn from the pattern of which ones they fail.
Start with existence. Does the token contract exist, and is the source verified? This is the cheapest question in the entire process, and in 2026 it is still the one most often skipped, because asking it implies you do not already believe the story. If there is no contract, you are not doing diligence on a protocol. You are doing diligence on a pitch, and the correct output is a one-line memo.
If the contract exists, read the proxy pattern before you read anything else. An upgradeable proxy means the bytecode you audited is not the bytecode that will govern you in ninety days. The admin is the law; the implementation is a suggestion. Which means the next question is not "is the code safe" but "who can replace the code," and the answer is always an address. Follow it.
Follow the deployer next. Every wallet has a first inbound transaction, and that transaction has a counterparty. Was the deployer seeded from a centralized exchange hot wallet, a bridge, or a mixer? What was the block timestamp? Now pull the other deployers in the same cohort and compare. I have traced a launch advertised as "decentralized from genesis" where thirty-one of forty wallets received their first ETH from the same exchange hot wallet inside a single block range, then distributed to a second ring that never touched the first. That is not forty teams. That is one entity with forty costumes, and the "ecosystem" in the deck is a spreadsheet with a funding graph behind it.
Then the multisig. Cardinality is the number everyone quotes and the number that means the least. A 5-of-9 sounds like governance; it is theater if all nine signers were seeded from the same address in the same hour. Check the funding source of each key, not the count. Check whether any signer has ever signed anything else. Check whether the threshold can be lowered by the same set that holds it — because if it can, the threshold is decorative. I have watched a "decentralized" treasury with nine signers resolve, on inspection, to one operator and eight addresses that had never sent a transaction that wasn't gas.
Repositories are forensics, not marketing. A real engineering team leaves a commit graph with texture: refactors, reverted merges, CI failures, dependency bumps at 2 a.m., tests written after the bug that motivated them. A staged repository has a flat graph — everything lands in two or three bursts, authored by one identity, no merge commits, no issues, and a README describing a system the code does not implement. Check whether it is a fork with the branding swapped. Check whether the tests touch the accounting paths or only the happy path. The commit graph is a behavioral record; you cannot fake texture at scale.
Then the arithmetic, which is where most of these projects actually die, regardless of whether the code is real. Pull the unlock schedule and compute float at TGE against the marginal buyer. If twelve percent circulates at launch and forty percent cliffs at month six, and the only identifiable demand is a points-farming cohort whose entire strategy is to exit on day one, then price is a function of exit velocity and nothing else. No amount of technical sophistication survives that schedule. I have run ten thousand leverage scenarios against a protocol whose interest model was celebrated as elegant; the elegance held until a rounding error met a volatility regime nobody had modeled. The schedule is the product. Everything else is decoration.
Liquidity custody is the next null. "Locked" is a word, not a mechanism. Locked to what — a third-party locker with a migration function the deployer still controls? Read the locker's ABI before you read the tweet. A lock that can be migrated is a lock with a key, and the key is held by the party you were trying to constrain.
Audits are point-in-time and scope-bound, and the only question worth asking is whether the report names a commit hash that matches the deployed bytecode. Most do not. In my Axie work the flaw was not in either contract — it was in the interaction between them, in the gas optimization that made a high-traffic path cheap enough to reenter. No per-contract audit would have caught it, because the audit boundary and the attack surface were different shapes. Terra is the same lesson at a larger scale: the failure was not a broken primitive but an uncoupled one, a single liquidity withdrawal propagating through a mechanism with no circuit breaker. The exploit wasn't in the code. It was in the boundary the code did not model.
The information vacuum is also, sometimes, legal engineering rather than incompetence. A raise structured as a SAFT with no public token claim, no documentation of a security-like instrument, and no named entity is a structure designed to be un-actionable — by a regulator, by a class action, by a counterparty. The absence of a whitepaper is the absence of a document that can be read as a promise. That is a deliberate choice, made with counsel, and it tells you something precise about how the team models its own downside. When a team engineers its own un-accountability before it engineers a product, the ordering is the thesis.
Now add the 2026 layer, which is the part most allocators have not priced. AI agents are reading this data and writing theses from it. Ask a model to evaluate a null target and it will not return null — it will return a confident report, because the model is trained to complete patterns, not to refuse them. I spent part of last year tracing an agent that consumed corrupted oracle feeds from a compromised node and executed on them without a sanity check. The failure was not the bad data. The failure was that the agent's output schema had no branch for "insufficient information." The null target is precisely the input that breaks that class of system, and there is now a meaningful amount of capital being allocated by systems that cannot say I don't know. A diligence process that cannot return an empty result is not a diligence process; it is a confirmation engine.
That is the whole protocol. Existence, proxy admin, deployer trail, signer independence, commit texture, unlock arithmetic, liquidity custody, audit scope. Each check is cheap, and each returns an artifact or a null. The null target failed all eight. Not one of them was ambiguous. The reason the report matters is not that the project is fake — I cannot prove that, and I will not pretend a null is a verdict. The reason it matters is that the cost of producing any one of those artifacts is close to zero for a team that intends to deliver, which means the refusal to produce them is itself a decision, made by someone, with a reason.
Here is where I have to be fair to the bulls, because the lazy read of this piece is that the market is irrational. It is not. The market is pricing exactly what is for sale, and what is for sale is not a protocol. It is a call option on a narrative, with a known expiry and a known counterparty, and most of the people in the trade know the option is out of the money. The buyer is not deceived; the buyer is early. Those are different positions, and conflating them is how you end up writing moralistic columns instead of risk reports. The hundred million was not raised from people who thought there was code. It was raised from people who thought there would be a bid at a higher price before anyone asked for the code. On that specific question, they have historically been right, and being right about it is not the same as being correct about the asset.
I also have to concede the bias in my own method. I over-index on artifacts, and artifacts do not predict survival. I have watched rigorously audited protocols with clean commit graphs die of a bad unlock schedule, and I have watched sloppy teams ship for six years because their incentive design was conservative. Code quality is a necessary condition for a durable protocol. It is nowhere near sufficient, and anyone who sells you a checklist as a substitute for judgment is selling you a different null.
And stealth is legitimate. Plenty of serious teams withhold identity, withhold docs, withhold the token address, and they are right to — front-running, regulatory exposure, and competitor cloning are real costs. The distinction that matters is that legitimate stealth hides identity, not existence. A serious team still has a deployer address, still has a repository, still has a legal wrapper somewhere. They hide who they are. They do not hide that they are. The null target hides existence, which is not stealth. It is a magic trick, and the trick only works while the audience is looking at the deck.
So the diligence question changes. It is no longer "is the code safe." It is "does the code exist, and who can change it." Ask for one artifact — the deployer address — and watch what happens to the timeline. If the answer is a deck, you have your answer. If the answer is an address, you have work to do, and it will take an afternoon.
The uncomfortable part is that this is not a technology problem. The tools to run all eight checks are free and public, and have been for years. The gap is that verification carries no fee, and the raise does. Greed is the feature; the bug is just the trigger. When the incentive to check is weaker than the incentive to allocate, the null target is not an anomaly in the market. It is the market working exactly as configured. The question for the next cycle is whether anyone gets paid to say zero — and until someone does, expect the report to keep coming back empty.
