The most useful document I read this quarter contained almost no information. It ran to several thousand words, laid out a nine-dimension analytical framework โ technology, token economics, market structure, ecosystem position, regulatory exposure, team and governance, risk surface, narrative, and supply-chain contagion โ and then, under each heading, returned the same answer. N/A. Information insufficient. Cannot evaluate. Over and over, with the mechanical regularity of a metronome, the report refused to say anything it could not support. Nine dimensions of a deep analysis, and the honest output was a wall of deliberate silence.
I want to be precise about what happened, because the story is less boring than it sounds. A research pipeline had two stages. The first stage was supposed to decompose a source text into structured facts: names, numbers, claims, the minimum viable set of data points that any downstream reasoning depends on. The second stage was supposed to take those facts and produce judgment. When I received the output, what I found was this โ the first stage had failed completely. No title, no source, no core thesis, no list of information points. It passed an empty vessel downstream. And the second stage, handed nothing, did something unusual for this industry. It declined to invent.
Every field was marked. The technology assessment said no technical scheme could be identified. The token economics section stated flatly that a tokenomic conclusion drawn from zero input would be fiction, and that publishing it would violate a principle it called analytical honesty. The regulatory section mapped the Howey test against four blank rows and concluded N/A. The risk matrix had exactly one entry with a real probability attached to it: the risk that the process itself had broken. The single highest-confidence inference in the entire document was not about any protocol or any token. It was about the reliability of the tool doing the reading.
I have spent twenty-eight years watching people build financial infrastructure, and the last nine of those years watching them build it on-chain. I have sat through bull markets that smelled like ozone and bear markets that smelled like ash. And I can tell you that the most expensive bug I have ever seen in a decentralized protocol was not a reentrancy exploit. It was not a bridge with a single signer. It was this: a system that received empty input and behaved as though it had received something.
The report I was handed did the opposite. It is, in its own quiet way, a specimen of the rarest virtue in this industry โ the discipline of refusing to hallucinate. And that is the reason I cannot stop thinking about it, because that virtue is precisely what almost no protocol on Earth has.
To understand why, you have to understand what the two-stage pipeline actually is in a decentralized system, and why the seam between the stages is where the money dies.
Every DeFi protocol is a stage-two processor. It does not generate its own truth. It consumes truth produced elsewhere and converts it into action โ a liquidation, a swap, an interest accrual, a governance execution. The oracle is stage one. The sequencer is stage one. The governance voter is stage one. The bridge validator set is stage one. Each of these subsystems is responsible for producing the structured input that the protocol's core logic then reasons over. And here is the part that took the industry a decade to learn and is still learning: the protocol's security model is only ever as strong as the honesty of the stage-one handoff. The cleverest smart contract in the world is a hallucination engine the moment its input is empty.
When I joined the Core Protocol team at Zilliqa in 2017, during the first ICO frenzy, I spent three months auditing the sharding implementation in Go. Everyone around me wanted the mainnet to launch on schedule, because the schedule was the product and the product was the token and the token was the point. What I found instead, deep in the consensus path, was a race condition โ a window where two shards could momentarily disagree about the state of a cross-shard transaction, and the resolution depended on timing that no one had stress-tested. It was not a dramatic bug. It was a seam. It was stage one producing an ambiguous answer and stage two being asked to act on it anyway.
I argued for a delayed launch. I argued that we should build a more transparent governance layer around the fix, that the community deserved to see how we handled our own failure, that decentralization requires patience rather than performance. We delayed. It cost the team real funding, real momentum, real narrative oxygen in a market that was sprinting past us. I have never once regretted it. That decision is where my voice stopped being purely operational. It is where I began to understand that speed is a drug, and the withdrawal is always a seam.
The report I received this quarter is the same lesson, scaled up and applied to the industry's data layer instead of its consensus layer. It passed an empty input downstream and the downstream refused to fabricate. Now I want to walk through the three places in Web3 where that same empty-input pathology is most expensively hidden โ oracles, sequencers, and governance โ because that is where an N/A doctrine like the one in that report would save billions or cost billions, depending on whether we adopt it.
Start with the oracle, because the oracle is where the empty input problem is most literal and most lethal.
A price feed feels like a fact. It renders as a number on a dashboard, and numbers feel objective. But a price feed is the output of a stage-one process with assumptions baked so deep into it that most integrators never see them. The oracle does not know the price of an asset. The oracle knows the price of an asset on certain venues, under certain conditions, weighted a certain way, over a certain window. That is stage one. And when any of those conditions degrades, the oracle continues to output a number โ a confident, precise, two-decimal number โ while the input that produced it has quietly gone empty.
In the summer of 2020, at the height of DeFi Summer, I led product strategy for a new lending protocol. My job was to make the engine run. My job became something else when I sat down with the Compound governance mechanics and realized that the entire "code is law" ethos we were all chanting was masking a much older problem: centralized oracle manipulation hiding behind mathematical language. The contract was deterministic. The input was not. I wrote a whitepaper then called "The Illusion of Sovereignty," arguing that algorithmic stability rests on fragile human assumptions โ that a liquidation engine is only as sovereign as the human-run price source feeding it. It caused a fight. It also caused us to integrate decentralized price feeds, and eventually it caused other teams to do the same.
What I did not fully articulate then, and what the N/A report clarified for me now, is that there are two distinct failure modes and the industry almost always conflates them. The first is wrong input: the oracle reports $1.00 for something worth $0.80. That is a lie. Everyone watches for the lie. The second, and far more dangerous, is empty input: the oracle reports $1.00 for something that has no market at all โ a token whose pools have drained, a venue that has halted, a price constructed from a single thin AMM pool that no rational actor could exit through. That is not a lie. It is the sound of a number being printed over a vacuum, and it looks identical on a dashboard.
Consider the mechanics of a time-weighted average price, which is the workhorse construction for on-chain feeds. A TWAP smooths a price over a window to resist single-block manipulation. The design assumption is that within that window, a real market exists โ buyers, sellers, liquidity, arbitrageurs enforcing a fair value. Now imagine the window opens onto a pool with two hundred thousand dollars of liquidity and a token whose only other market is a centralized exchange that has quietly suspended deposits. The TWAP will happily compute a number. It will look stable, precisely because the thin pool cannot move much, and that stability will be read by every integrator as confidence. A TWAP on an empty market is not a price. It is a rumor with a smoothing function. The stage-one handoff has gone hollow, and stage two โ the lending protocol, the perp engine, the vault โ will liquidate real users against a fiction.
This is not hypothetical. In March 2023, when USDC briefly depegged to around $0.88 following the disclosure of exposure to a failed bank, the interesting question was never whether the depeg was real. The interesting question was what every protocol would do with an input that had suddenly become ambiguous. Some venues halted. Some kept quoting. Some lending markets froze their USDC markets; others did not, and users were liquidated into a price that reflected panic more than value. The chain of decisions that followed โ freeze, pause, adjust the feed, override the parameter โ was, in every case, a human decision about what to do with an input that had gone empty of meaning. The contracts did not decide. The humans did. And most of them decided in the dark, in real time, with depositors' money on the line.
Where this becomes structural rather than episodic is the L2 sequencer relationship, and this is where I want to spend serious time, because it is the single most under-analyzed dependency in the entire DeFi stack.
When a lending protocol lives on an L2 โ Arbitrum, Optimism, Base, Linea, any of them โ its oracle does not just need a price. It needs to know whether the L2 is producing blocks at all. Because if the sequencer halts, the price feed on the L2 freezes at its last value while the real market on L1 keeps moving. A frozen feed is the purest form of empty input: it is a stage-one output that has stopped updating but has not stopped being read. The standard mitigation is a "sequencer uptime feed" โ a separate oracle that tells the protocol whether the sequencer is up โ combined with a grace period: after the sequencer comes back, wait X minutes before trusting prices again, on the theory that the first blocks after a restart may carry stale or manipulated trades.
The existence of that mechanism is an admission, and we should read it as one. It is the stack telling you, in the language of parameters, that the L2's core liveness guarantee is a single centralized node, and the entire DeFi ecosystem built on top of it has a hard-coded contingency for that node going dark. The grace period is the N/A doctrine, industrialized. It is stage two saying: I cannot trust this input yet, I will wait, I will not act. Which is correct. Which is also the sound of a system quietly conceding that its foundation is not what the marketing said it was.
I have watched the sequencer outage record with the specific attention of someone who once argued for a delayed launch because of a race condition. In June 2024, Linea halted block production for roughly an hour; the cause was a third-party RPC provider pushing a bad configuration, and the chain simply stopped. Arbitrum, which is the largest L2 by most measures, has had its own outages. Base has had degraded performance. Optimism's Bedrock upgrade re-architected the sequencer but did not decentralize it. Each of these events produced the same downstream ritual: the feeds froze, some protocols paused, some did not, and the community argued afterward about whether the pause was justified. Now look at the timeline I actually care about. "Decentralized sequencing" has been on the roadmap โ on the slide deck, in the blog posts, in the conference keynotes โ for approximately two years and running. There are proposals. There are designs. There is a shared sequencer narrative, and there is a Based rollup narrative, and there is an Espresso narrative. There is no production-grade, widely-adopted, genuinely permissionless sequencer set running the throughput of the biggest L2s. That is not a controversial claim. It is a fact you can verify by reading the sequencer's uptime status page.
So here is the seam, stated plainly: a billion-dollar lending market on an L2 is, at the input layer, dependent on a single machine's continuing willingness to order transactions. And when I say the input can go empty, I do not only mean during an outage. I mean every block. The sequencer is stage one, and stage one is a node in a data center, and everything downstream has been engineered to pretend that it is not.
Now, the counterargument comes fast and it is worth taking seriously, because this is where the empty-input pathology shows its third and most morally interesting face. The counterargument is the escape hatch: the force-inclusion mechanism, the ability for any user to submit a transaction directly to L1 if the sequencer censors them, the one-day delay window during which anyone can propose a state root. The escape hatch is supposed to make sequencer centralization a liveness problem rather than a safety problem. If the sequencer misbehaves, you go around it. The input is never truly empty because there is always the L1 backstop.
And this is where I have to be honest, because the escape hatch is real but it is also a classic N/A doctrine failure dressed as a feature. The escape hatch exists. The escape hatch has essentially never been used at scale. The cost of using it โ the friction, the capital, the technical competence required, the one-day forced delay, the fact that it must be initiated by a party monitoring the sequencer continuously and willing to burn gas on a certainty that only materializes in a crisis โ means that in practice it functions as a theoretical guarantee. It is the analytic equivalent of a report that can, in principle, produce a full analysis, but in the actual conditions of use returns N/A for the dimensions that matter. A backstop that is too expensive to invoke is not a backstop. It is a signed confession that we hope we never need the backstop.
When I helped design a grant program inside the Polkadot ecosystem during the 2022 winter, I made a deliberate choice that I now see as the same principle. I prioritized foundational research over marketing-heavy projects. I did it because the post-FTX collapse had left me unable to support anything that lacked genuine utility, and because I needed my work to be authentic โ I could no longer fund a project whose only real output was a narrative. What I learned from that grant cycle is that the ecosystem had no shortage of beautiful theory about how systems would behave under adversarial conditions. It had a severe shortage of evidence about how systems did behave when the input got messy. The gap between the theory and the evidence is the escape hatch. It is the sequencer decentralization roadmap. It is the grace period that presumes the sequencer will come back. It is the whole architecture of confident assumptions standing in for tested behavior.
And the third face of the empty-input problem โ the one that I think is the most human, the most quietly corrupting, and the one that took me the longest to see clearly โ is governance.
Governance is a stage-two processor in the purest sense. Its input is the collective preference of the token holders. Its output is a binding decision. In theory, the input is the most robust in the entire stack, because it is supposed to be the aggregated intent of tens of thousands of participants with skin in the game. In practice, the input is almost always empty, and the delegation mechanism is the reason.
When I analyzed Compound's governance mechanics back in 2020, I noticed the thing everybody notices after about a week: the overwhelming majority of token holders never vote. The ones who do vote are a small set of delegates, and the delegates are, increasingly, not the most informed participants but the ones with the largest delegated balances โ which is to say, the KOLs. Delegation was designed to solve the coordination problem of direct democracy. What it actually does, when you trace the input all the way back, is this: a user who is too busy or too lazy or too uninformed to research a proposal delegates their voting power to someone whose track record they do not deeply verify, and that delegate then votes on behalf of millions of tokens they do not own. The vote passes. The output looks legitimate. The input was never there. Nobody researched the proposal. Nobody formed an opinion. The governance system processed an empty input and produced a confident decision, and the confident decision triggered execution, and the execution changed the protocol.
This is more than an efficiency problem. It is a security problem, because a delegate with a large enough following can effectively control outcomes, and the cost of acquiring that delegation is not the cost of acquiring the tokens โ it is the cost of acquiring the audience. When I watched the Compound governance drama unfold around a delegate campaign that used borrowed tokens to push governance influence, the technical shape of the attack was less interesting to me than the input shape. The attacker did not need to buy the votes. They needed to convince enough token holders that their vote was not worth a moment's thought, and then collect it.
I want to be careful about the language here, because the way I feel about governance delegation is the way I felt standing in the Cordillera Mountains during my 2021 sabbatical, looking at the NFT market from a distance and realizing that the spiritual hollowness of speculative art trading was not a market condition. It was a design condition. I had entered this industry to empower individuals. I watched the industry build systems that made individuals feel empowered while quietly converting their agency into a number. Governance delegation is the same move, pointed at decisions rather than pixels. The user feels like a voter. The user is a supply of voting power that someone else spends. The input goes empty at the exact moment it is transferred.
And I keep coming back to why that is not generally treated as a crisis, whereas a reentrancy bug is treated as a five-alarm fire. The reason is that an empty input does not look like a failure. A hallucinated output is indistinguishable, on the dashboard, from a correctly computed one. The report I received this quarter was valuable precisely because it broke that spell โ because, faced with empty input, it returned the word N/A instead of a confident lie. The reason the N/A doctrine is so rare in Web3 is that the industry has trained itself to reward the appearance of a working system over the reality of a working system, and an empty input produces a deceptive but perfectly convincing appearance.
Now I owe you the contrarian move, because everything I have said so far could be read as praise for refusing to hallucinate, and if I leave it there I will have told you a story that flatters us. So let me do the harder thing and argue the other side.
The N/A doctrine is not a virtue. It is an abdication, and the system that returns N/A most beautifully is often the system with the least intention of ever fixing its input.
Think about it. A report that says "cannot evaluate due to insufficient data" looks rigorous. It reads as humility. It is accountability theater of a very sophisticated kind, because it allows the system to take credit for honesty while bearing no responsibility for the fact that the data was never collected. The genuine failure was upstream โ stage one did not produce facts. Stage two's refusal to fabricate is admirable, but stage two is not the hero of this story. Stage two is the colleague who arrives at the meeting, announces that the numbers are missing, and leaves. The hero is the person who goes back to stage one and fixes the extraction. And in crypto, almost nobody goes back.
This is the trap. "We are waiting for further data" has become the industry's most respectable way of saying "we are not going to change anything." The sequencer stays centralized "until the decentralized design is ready" โ indefinitely, because there is no deadline that costs anyone anything. The protocol's governance stays delegated "until voter participation improves" โ indefinitely, because low turnout is not treated as a bug. The oracle's thin-market assumptions stay in place "until better sources mature" โ indefinitely, because the number keeps printing and the liquidations keep happening and nobody tracing the trade back to the feed is going to be the one who writes the incident report. The grace period, the escape hatch, the delegation model โ these are all versions of the N/A doctrine operating in production, and every one of them functions as a permanent excuse. They convert a solvable upstream problem into a permanent downstream disclaimer.
The contrarian implication is uncomfortable and I will state it directly: the most dangerous system in the room is not the one that produces a confident wrong answer. It is the one that tells you, with perfect honesty, that it cannot be sure โ and then keeps operating anyway, because the honest disclaimer has been priced into the product as a feature rather than treated as a defect to be repaired. A protocol that liquidates users against a frozen feed and then publishes a transparent post-mortem explaining the outage is not more trustworthy than a protocol that quietly throttled the feed. It is just better at the ceremony. Honesty about a broken input is not the same thing as fixing the input, and our industry has been systematically confusing the two for years.
I know this because in 2022, after the collapse of FTX, I felt the exact version of this confusion. I had spent years advocating for transparency, for decentralization, for community governance, and then the industry's most public-facing leadership turned out to be a facade, and I retreated from public discourse for weeks, unable to reconcile what I had been telling people with what had been true. When I came back, the lesson I extracted was not that transparency is worthless. It was that transparency had been offered as a substitute for substance, and that a sufficiently transparent account of a hollow system is still a hollow system. The N/A report would have been proud of FTX's post-mortems. The post-mortems did not bring back the deposits.
So what is the actual fix? I do not think it is a smarter contract. I think it is a change in what we demand at the seam.
The fix at the input layer is redundancy that is used, not merely present. An oracle that draws from fifteen venues when ten of them have zero liquidity is not a decentralized oracle. It is a centralized oracle with a longer list of excuses. The number of sources is irrelevant; the usable liquidity behind the sources is the whole game, and any feed that does not surface a liquidity-quality metric alongside the price is handing stage two an input it cannot evaluate. If I were designing feed standards today, I would require every price to ship with a confidence band derived from executable liquidity, and I would make protocols that consume a price with a hollow band into a violation, the same way consuming a stale price is a violation. We already have the infrastructure to do this. We lack the institutional will, because surfacing liquidity quality would reveal how thin most of these markets actually are.
The fix at the sequencer layer is to stop treating "decentralized sequencing" as a destination and start treating it as a mandatory migration with a deadline and a cost. The escape hatch should be cheap and tested โ regular, scheduled, public force-inclusion drills, the same way we run chaos engineering on exchanges. If the backstop has never fired, we do not know it works; we know it exists. Existence is not a security property. I have seen far too many smart contracts that "handle" a failure path that has never once executed in a test, let alone in production. A mechanism that has never fired is a mechanism we are guessing about.
The fix at the governance layer is to be honest that delegation is a structure, not a bug, and to decide whether we want it. If we keep it, we should require delegates to publish their reasoning, their positions, and their conflicts, and we should treat an unpublished vote as an abstention rather than a decisive input. But I suspect the deeper move is to accept that most token holders will never research proposals, and to stop pretending that their vote โ which they know they are not qualified to cast โ constitutes the input. A system that manufactures the appearance of participation is more dangerous than a system that admits it is run by a small group, because the manufactured appearance prevents anyone from holding the small group accountable. I would rather know who is deciding than watch a quorum of ghosts decide for me.
And there is a version of this problem arriving right now that makes all the others look like rehearsal, and it is the reason I have spent the last two years arguing for what I call algorithmic empathy.
We are entering a period where AI agents act on-chain. They trade. They manage treasuries. They execute governance on behalf of delegators. They consume data and convert it into transactions, at machine speed, at machine scale. An AI agent is a stage-two processor that never gets tired and never doubts itself. And what does it consume? Stage-one inputs. Oracles, sequencers, governance signals, social feeds. Now ask the obvious question: what does an AI agent do when the input goes empty? A human trader sees a frozen feed and feels uncertainty. A human delegate sees the proposal and, sometimes, reads it. An AI agent trained to optimize will act โ because acting is what it is rewarded for, and because an empty input rendered as a confident number looks exactly like a full one. An AI agent will liquidate a market against a hallucinated price with perfect confidence, at three in the morning, while every human in the loop is asleep, and it will not know it has done anything wrong.
This is not a distant scenario. It is the direction of the entire industry. And it is why the N/A doctrine โ the discipline of refusing to act on empty input โ has to move from a document's footnote to a protocol's core design principle. Blockchain's genuine value proposition, the thing that justifies all the years and all the losses, is that it can provide a verifiable layer of human intent in a world increasingly saturated with synthetic content. That is the gift the technology can give: not speed, not yield, but proof about where a decision came from and who authorized it. And a system that cannot tell the difference between a full input and an empty one has no business being the substrate for that proof. It will verify a lie. It will execute a ghost.
The report I read this quarter got one thing exactly right, and I want to end where it did, because the discipline it demonstrated is the discipline the whole industry needs to internalize before the agents arrive. Faced with nothing, it produced N/A. It did not blink. It did not guess. It did not dress an empty vessel in the language of confidence. It named the failure at the seam โ the point where stage one handed stage two a void โ and it refused to paper over it.
I have spent twenty-eight years in this industry, and I have learned that the failures that cost the most are never the ones that announce themselves. Burnout is the tax on innovation, and so is the empty input, and we have been paying both without properly accounting for either. The report did not fix anything. That is the point. Its honesty was necessary but not sufficient, and if we mistake the N/A for the answer, we will have learned nothing from it. Code betrays when we do โ and the specific way we keep betraying it is by building systems that would rather look certain than admit they are fed on silence.
The work in front of us, the work I intend to spend the next chapter of my career on, is not to teach machines to say N/A. It is to build the input layer so that machines do not have to. It is to make empty input rare rather than handling it gracefully. Verify the seam. Price the liquidity. Test the backstop. Name the delegate. And when the agent asks, at three in the morning, whether the market is real, build a system that can answer honestly โ not with a number where no market exists, but with a proof of who said so. The technology is capable of that. Whether we choose to build it that way is not a technical question. It never was.