The Null Return: Why the Hardest Function in Crypto Is the One That Refuses to Compute

The artifact

Last month I read the most honest artifact produced this cycle. It was four thousand words of N/A.

Nine analytical dimensions — technical surface, token economics, market structure, ecosystem position, regulatory exposure, team and governance, risk matrix, narrative, supply-chain propagation. Each returned the same value. Not a range. Not a probability. N/A. Then the pipeline did something I have almost never seen a human analyst do: it printed a dependency table diagnosing its own starvation, listed the minimum information set required to proceed, and halted.

No project name was invented. No token supply inferred from a vibe. No "sources suggest." The information entropy of the input was zero, and the output matched it. It flagged its own upstream as broken rather than papering over the gap with prose.

In a market where a nine-figure raise can be announced before the whitepaper resolves, that document is the rarest thing on the wire. A null return is a proof. A confident guess is a rumor with better formatting.

The interesting question is not whether the pipeline was right. It was. The interesting question is why the same discipline is almost entirely absent from the infrastructure we actually route capital through — oracles, bridges, sequencers, liquidation engines, and now the research agents that read them all. Every one of those systems can be called with empty, stale, or poisoned input. Almost none of them are built to return ⊥.

Context: the marginal cost of a plausible sentence collapsed

Here is the supply chain as it currently exists.

On one end, primary sources: contract bytecode, mempool data, node RPC responses, proof transcripts, governance calldata, archive-node state. Finite. Verifiable. Expensive to read properly.

On the other end, narrative: threads, reports, research decks, agent outputs, newsletter takes. Effectively infinite. Near-zero marginal cost.

For most of the industry's history the bottleneck sat in the middle — someone had to do the reading. That bottleneck is gone. A language model with a browser and a token budget will produce twenty pages on any contract address you hand it, in ninety seconds, in confident prose, with a table of contents and a valuation range. The cost of producing a document that looks like research has collapsed by roughly three orders of magnitude. The cost of producing research has not moved at all.

There is a structural detail in the artifact I keep returning to, because it explains why the pipeline behaved correctly where a human would not have. The nine dimensions were not free-form prompts. They were fields in a schema, and every field carried a required source annotation. A schema with a mandatory provenance field cannot be satisfied by an empty retrieval step. The abstention was not a decision the system reached at the end of its reasoning. It was a property of the data structure from the beginning. That is the difference between discipline and willpower, and only one of them scales.

That asymmetry has a predictable equilibrium. When the cost of a false positive approaches zero and the payoff to confidence is positive, you get a market for lemons — except the lemons are not cars, they are claims, and they clear instantly because nobody has time to inspect one before the next block lands.

I learned this in 2018, in the ICO chaos, when the ratio of whitepapers to shipped contracts was roughly forty to one. I spent three months on the 0x protocol v2 contracts instead of on the conference circuit. Reading the atomic swap logic line by line, tracing the relayer fill paths, I found seven edge cases in the exchange logic that the specification did not enumerate — partial fills interacting with fee recipients, order-hash collisions under specific nonce arrangements, cancellation races against fills. I filed them to the GitHub repository rather than announcing them in a Telegram group. That decision cost me a great deal of visibility and bought me the only thing I actually wanted: a reputation grounded in primary sources rather than in reach.

Eight years later the discipline is identical and the stakes are higher. The difference is that in 2018 the people producing noise were humans with incentives to produce it. In 2026 the noise produces itself, at scale, for free, and it is indistinguishable by construction from the real thing until someone runs the trace.

Core: what a null actually is

Null is a value, not an exception

Most engineers treat ⊥ as an error condition. Wrong framing. Null is a return value, and it carries more information than any number you could substitute for it.

Consider the three-state lattice {⊤, ⊥, unknown}. Boolean logic has two states. Production systems need three. Kleene's strong three-valued logic has been available since 1952; SQL has had NULL since the 1970s, with all the join-propagation semantics that entails. The crypto industry re-derived none of it. We built price feeds with two states — a number and a revert — and then acted surprised when every interesting failure lived in the third.

Watch what happens in Solidity:

// Two-state design. The failure mode is invisible.
function getPrice() external view returns (uint256) {
    return latestAnswer; // stale? zero? clamped? the caller cannot tell.
}

// Three-state design. The failure mode is in the type. function getPrice() external view returns (uint256 price, uint256 updatedAt, bool valid) { return (latestAnswer, lastUpdateBlock, _isFresh() && _inBounds()); } ```

The first signature compiles. It is also a lie. latestAnswer will happily return a number that was true eleven hours ago, or a number that has been clamped to the aggregator's configured floor, and the caller has no syntactic way to distinguish that from a fresh print. The type system actively hides the null.

This is not a Solidity problem. It is an interface design problem, and it recurs everywhere: RPC providers serving cached state with a 200 status, indexers serving partial reorgs, subgraphs lagging the head by an unknown number of blocks, and now AI research agents emitting a complete report when the retrieval step returned nothing. Same bug. Different compiler.

The oracle case is the null case

Chainlink's aggregator contract exposes latestRoundData(), returning five values: round ID, answer, startedAt, updatedAt, answeredInRound. The staleness check the documentation recommends looks roughly like this:

(, int256 answer, , uint256 updatedAt, ) = feed.latestRoundData();
require(answer > 0, "bad answer");
require(block.timestamp - updatedAt < HEARTBEAT, "stale");

Every clause there exists because someone lost money.

answer > 0 exists because of the minAnswer clamp. When an asset trades below the aggregator's configured floor, the feed does not revert — it returns the floor. The floor is a real number. It is not the price. The number and the truth diverged, and the interface did not say so. Protocols that trusted the two-state version got liquidated against a price that never existed on any venue.

updatedAt exists because a feed whose heartbeat has lapsed is not a feed. It is a memory of a feed, and the distinction is the entire product.

answeredInRound is the subtlest of the five, and the one most integrations drop. It exists to detect the case where a round was carried over — where the answer you are reading was produced by an earlier round than the one you think you are querying. Dropping it re-introduces exactly the staleness the rest of the check was designed to prevent.

You can see where this goes. A stale oracle and a hallucinated research report are the same object. Both return a fresh-looking value derived from no current evidence. Both carry a timestamp that implies recency. Both have no error surface — the caller receives a success status and a plausible body. And in both cases, the consumer's default behavior is to act on it.

The industry has shipped exactly one widely-used production example of the correct pattern, and it is worth naming because it is instructive. On L2s, protocols consuming price feeds are told to check a second feed: the sequencer uptime feed. If the sequencer has been down, or has come back up within a grace period, the price feed is not to be trusted regardless of its own freshness — because its freshness is an artifact of the halt, not evidence of liveness. That is a null propagated from one system into the schema of another. It is the right design. It is also one of the only times the industry has shipped it, and it shipped because an outage forced the issue.

I have a specific grievance about the other half of the oracle question. The industry's answer to decentralization has been to multiply nodes while keeping the trust topology fixed. A nine-node quorum sounds robust until you pull the infrastructure: how many of those nodes share a cloud region, an RPC provider, a key-management vendor, a monitoring stack? Count it. The answer is usually four. Four identical failure domains behind nine signatures is a decentralization claim that does not survive contact with the bytecode. The honest artifact would be a feed that returns ⊥ when the quorum's independence falls below threshold, not merely when its count does. Nobody ships that, because the number would be embarrassing and the liveness cost would be real.

Math doesn't care about your node count.

The information bound

There is a formal version of this argument, and it is not philosophy.

Let the input be a random variable X and the output a random variable Y. If the pipeline has no information about the subject, X and Y are independent, and

I(X; Y) = D_KL( P(X,Y) ‖ P(X) P(Y) ) = 0.

Zero mutual information. The posterior equals the prior. Any output distribution that differs from the prior is not analysis — it is the injection of entropy that was never present in the input. The pipeline I opened was describing precisely this when it concluded that its input information entropy was approximately zero and that no analysis could proceed from it.

Information gain is bounded above by information in. This is not a stylistic preference or a matter of intellectual taste. It is a bound. A report that adds specificity — a float figure, a TVL number, an unlock schedule, a valuation range — to an empty input is not adding value. It is manufacturing it, and the manufacture has a cost that settles later, in someone else's position.

The corollary is uncomfortable for the research business: most published crypto analysis has negative expected value, not because it is wrong on average, but because its confidence is uncorrelated with its evidence. You cannot price that. You can only decline it.

Why language models structurally cannot return null

This is the part that matters for everyone shipping an "AI research agent" this quarter.

A decoder-only transformer is trained to maximize the likelihood of the next token given the prefix. At no point in pretraining is it rewarded for abstaining. The loss function has no ⊥ term. Fluent continuation is always the gradient direction. If the context contains a project name and no data, the highest-likelihood continuation is still a well-formed paragraph, because well-formed paragraphs are what the corpus contains. The absence of data is not represented in the weights as a category of input to be recognized. It is represented as nothing, and nothing does not steer.

RLHF makes it worse rather than better. Preference models are trained on human comparisons, and humans prefer an answer to a refusal. Ask a labeller to rank "the token has a 4% float and a 12-month cliff" against "I cannot determine the float from the available information," and the label goes to the first one, every time. So the reward model encodes the same bias, and the policy learns it. The model is not failing to abstain. It is succeeding at the objective it was given, and the objective is wrong for a research system.

This is a reward-hacking story, not a capability story. The fix is not a larger model. The fix is to move the abstention decision out of the sampling step and into a validation layer that runs after generation and before publication — a checker with no gradient and no preference for fluency.

I have built this pattern in a different domain, and the parallel is exact. When I analyzed Zcash's Groth16 setup in 2020, the object of study was a ceremony whose entire purpose was to guarantee that a specific piece of toxic waste either never existed or did not survive. If the ceremony fails, the system does not throw. It returns a valid-looking proof of a false statement. There is no error surface at all. That is the worst bug class in cryptography — not a system that breaks, but a system that lies correctly.

The five-thousand-word breakdown I published on that ceremony was not popular. It was cited. Citations come from people who read the math. Popularity comes from people who read the headline. Those two populations have almost no overlap, and only one of them has money at risk in your protocol.

Null-return integrity as an engineering requirement

So build it. Concretely.

One: make provenance a required field, not a metadata afterthought. Every claim in an output carries a pointer to the exact primary artifact it came from — a transaction hash, a storage slot read, a log index, a block height. If the pointer does not resolve, the claim does not ship. This is the same discipline as a zero-knowledge circuit: a proof is worthless without a witness, and a verifier does not accept a witness it cannot check.

Two: propagate nulls, never impute them. In SQL, NULL + 5 = NULL. That is correct behavior, and most people have spent careers fighting it. Fight the other direction. If an unlock schedule is unknown, the fully diluted valuation is unknown; it is not "approximately $400M, assuming." The assumption is a fabrication with better manners.

Three: expose abstention as a first-class metric. Publish the abstention rate. A pipeline that returns ⊥ on forty percent of its inputs is not broken. It is calibrated. A pipeline that returns ⊥ on zero percent of its inputs, across every possible input, is either operating in a domain of total knowledge or lying about its coverage. Which is more likely, given a market that announces a nine-figure raise before it publishes a whitepaper?

Four: separate retrieval from generation and put the gate between them. Retrieval returns evidence plus a completeness score. The gate refuses to pass an incomplete bundle. Generation never sees an empty context, because generation is structurally incapable of handling one honestly.

bundle = retrieve(project)
if bundle.completeness < MIN_COVERAGE:
    return Abstention(
        reason = NOT_ENOUGH_PRIMARY_SOURCES,
        missing = bundle.missing_fields,
        minimum_required = MINIMUM_INFORMATION_SET,
    )
report = generate(bundle)            # never called on empty input
report = validate(report, bundle)    # every claim resolves to a source

That is the entire pattern. It is unglamorous. It is also approximately what the document I opened last month was doing in prose, and it is what almost no deployed research agent does, because every one of them is measured on output volume by people who will never run the trace.

The NFT case: a failing test is the deliverable

In 2021 I refused the culture and audited minting contracts instead. Five hundred of them, plus derivatives. That work surfaced a rounding error in the accounting of a CryptoPunks derivative market that permitted unbounded minting — an arithmetic path where the mint counter wrapped relative to the escrow balance, so the same deposit could be claimed repeatedly.

I wrote a reproducer. A minimal failing test, callable, deterministic, running against the deployed bytecode at a pinned block. I sent it to the team. The response was approximately nothing.

Here is what I want to point out about that episode, because it is the whole thesis in miniature. The deliverable was not a report. It was a test that fails. A test that fails is a null return with a witness attached: it states, precisely, that the invariant does not hold, and attaches the trace, the block, and the call data. It requires no trust in my identity, my reputation, or my tone. Anyone can run it and get the same red line.

If I had instead published "this collection is undervalued, here is my thesis," it would have received a hundred times the engagement and been worth exactly nothing. Engagement is not a proof. Volume is not a verification. The industry confuses the two because the first is measured in public and the second is measured in the dark, by people who are not looking.

The Terra/Luna detour: the answer existed, the incentive didn't

After the 2022 collapse I disappeared for six months and read the consensus mechanisms of failed L1s. What came out the other end was a twenty-thousand-word paper on algorithmic stablecoin instability, framed as a game-theoretic problem rather than a post-mortem.

The finding was not exotic. Reflexive redemption structures have a determinate equilibrium under stress, and it is not the peg. When the marginal redeemer's payoff is maximized by exiting first, and exit capacity is finite, the equilibrium is a run. You do not need the deployed Terra code to derive this. You need the payoff matrix, the capacity constraint, and an honest treatment of both.

So the information existed in 2021. It was derivable. It was, in a limited sense, derivable from first principles on a whiteboard in an afternoon. What was absent was not knowledge. It was the incentive to publish a null-flavored answer while everyone else was publishing numbers. "This is unstable under reflexive redemption" is functionally a null return on the question what price — it declines to give a price and returns a structural property instead. Nobody wants that in a bull market. In a bull market, refusing to price something reads as refusing to participate, and refusing to participate is socially expensive in a way that being wrong is not.

The market's collective output during the collapse was enormous. Almost none of it contained a model that had been written before the collapse.

Contrarian: abstention is a liveness surface, not a virtue

Now the part the null-return argument gets wrong when it is carried too far.

Soundness and completeness are adversaries. A proof system that rejects every statement is sound and useless. A chain that never produces a block has never reverted a transaction and has never settled one either. A research pipeline that returns ⊥ on every input is perfectly honest and worth exactly its inference cost. The document I opened was correct and it was a symptom of a broken upstream. Both things are true, and an argument that only celebrates the first is as unserious as one that only complains about the second.

So the engineering problem is not "should the system abstain." It is "where is the threshold, and who pays when it is set wrong."

Put numbers on it. Let C_w be the expected cost of a wrong answer and C_n the expected cost of no answer, conditional on the same input. For a lending protocol consuming an oracle, C_w is not bounded — a wrong price is a wealth transfer, and the transfer can exceed the protocol's own capital when the borrow side is levered. C_n is bounded by the halt: positions do not move, liquidations queue, the protocol survives to the next block. A rational designer therefore sets the abstention threshold low and accepts the liveness hit.

Except the liveness hit is not bounded the way people model it, and this is the blind spot I want to name.

Abstention is correlated. If three of the four oracles a protocol accepts return ⊥ in the same block — because they share a data source, a cloud region, or a heartbeat schedule — the protocol does not degrade gracefully. It halts. And it halts at the same moment as every other protocol consuming the same feeds, which means the liquidation queues all form simultaneously, which means the first system to re-enable gets the best execution, which means the recovery is a race with a winner and several losers who did nothing wrong except share a dependency graph. The null case is not a per-system safety property. It is a systemic risk with a common mode, and the common mode stays invisible as long as you only audit one protocol at a time.

Worse: null is a griefing primitive. If a validator, a sequencer, or an adversarial data source can force your pipeline to abstain, then they hold a denial-of-service vector that costs almost nothing to trigger and is invisible in the logs, because abstention looks like caution. Poison the provenance — flood the retrieval layer with plausible junk that fails validation on a technicality — and you can drive the completeness score below threshold on demand, at the exact moment when an accurate reading would have been profitable for someone else.

This is precisely the shape of the problem my team worked on last year, when we co-authored the ZK-rollup standardization proposal that cut proof generation time by forty percent. The underlying trade — prover time against proof size, circuit arity against verification cost — is at bottom a trade between soundness and liveness. A polynomial commitment scheme parameterized for tiny proofs buys you a verifier that is cheap and a prover that is slow, which is fine until throughput matters. Any parameterization that optimizes one side and ignores the other ships a chain that either proves false things or stops producing.

The fix is not to raise the threshold. It is to require diversity of abstention causes. A system should never halt on a single class of missing evidence. It should degrade to the coarsest property it can still prove — not a price, but a bound; not a TVL figure, but the direction of net flow; not an unlock schedule, but the fact that one exists. Three-valued logic gives you the primitive. {⊤, ⊥, unknown} collapses into a fourth state — {⊤, ⊥, unknown, degraded} — the moment you admit partial evidence, and almost nobody builds the fourth.

There is a governance version of this that I find hardest to ignore. Projects present their decentralization as a policy question: a DAO, a foundation, a legal wrapper, a set of posted principles. It is not a policy question. It is a schema question. Who holds the keys, which addresses sign, what the upgrade path resolves to, what the timelock actually delays. The allocation a deck labels "community" resolves to a set of wallets that any archive node can trace, and the trace does not care what the governance forum voted on. Privacy is a protocol, not a policy. So is decentralization, and so is every other claim you make about your own system.

Takeaway

The next cycle will not be won by whoever produces the most research. Output volume is a solved problem; the marginal cost of a plausible paragraph is effectively zero and still falling, and the models producing them get better every quarter. The advantage that comes from generating more text has already been competed away.

It will be won by whoever can produce the most verifiable abstention. The infrastructure that matters over the next eighteen months is the infrastructure of provenance — systems that attach a resolvable witness to every claim, that carry a completeness score through every pipeline, that publish abstention rates next to accuracy numbers, and that degrade to provable bounds instead of halting or lying. The metric that will matter is not how often the model is right. It is whether anything it says can be checked by someone who does not trust it and has no reason to.

The document that started this essay would score perfectly on that metric and zero on usefulness. That gap is the frontier. A system that knows the difference between those two numbers — and can say so out loud, with a witness attached — is worth building.

Everything else is a rumor with a timestamp.

Math doesn't grade on confidence.