The Empty Schema: In a Bull Market, Crypto Cannot Verify What It Cannot Source

Last week a diligence pipeline I maintain returned a document. It had a title field. A source field. A summary. A list of extracted claims. A confidence score for each domain tag. It rendered cleanly. Every field was null.

I recognized the shape of the failure immediately. I have spent the past four months reconciling protocol dashboards against bytecode, and the collapse mode is identical every time. In February a fund manager forwarded me a page with visible pride. Nine figures of total value locked. Seven figures of daily volume. An interest rate curve drawn in a smooth gradient. I sampled the underlying token balances three hundred times across ten days and pulled contract state directly. The numbers did not close. Not by a rounding error. By a factor of forty.

The page was not lying. It was rendering. The protocol does not lie; the interface does. That sentence has been true since the first block explorer was written. It is more expensive to ignore now, because this cycle has industrialized the distance between what is displayed and what is true.

Provenance is the question of where a claim originates, and whether an independent party can reconstruct that origin without trusting the reporter. In cryptography this is not philosophy. It is structure. A signature establishes who signed. A Merkle proof establishes which leaf belongs to which root. Neither establishes that the signer was honest. Neither establishes that the root was computed over the correct set of leaves.

The industry has spent two cycles building excellent machinery for the second problem and almost none for the first. We can prove that a state transition was valid. We struggle to prove that the inputs to that transition were what someone said they were.

This is not an abstract gap. It is the operating condition of the bull market. Research reports circulate with no primary source. Dashboards quote numbers nobody has reconciled. "Real yield" is a marketing term with no agreed definition. The velocity of capital rewards the claim, not the check. And the check is expensive. Reproducing a figure costs hours. Accepting it costs nothing.

Four technical domains make the cost concrete. Interest rate models in DeFi, where a policy parameter is displayed as a market price. Layer2 sequencers, where one operator holds the ordering pen. The family of "Bitcoin Layer2s," where a label has replaced an attestation. And AI training-data provenance, arriving fast, where provenance is not adjacent to the product. It is the product. That last one raises the number of people willing to sell a green checkmark.

Start with the curve.

Compound's interest rate model is a piecewise linear function with four constants. The implementation is short enough to read on one screen.

function utilizationRate(uint cash, uint borrows, uint reserves) public pure returns (uint) {
    if (borrows == 0) return 0;
    return borrows * 1e18 / (cash + borrows - reserves);
}

function getBorrowRate(uint cash, uint borrows, uint reserves) public view returns (uint) { uint util = utilizationRate(cash, borrows, reserves);

if (util <= kink) { return (util multiplierPerBlock / 1e18) + baseRatePerBlock; } else { uint normalRate = (kink multiplierPerBlock / 1e18) + baseRatePerBlock; uint excessUtil = util - kink; return (excessUtil * jumpMultiplierPerBlock / 1e18) + normalRate; } } ```

Read this carefully. The function observes exactly one thing about the world: the ratio of borrows to available cash. It does not observe a borrower. It does not observe a lender. It does not observe a term structure, a credit spread, or a single negotiated rate. The four constants — baseRatePerBlock, multiplierPerBlock, kink, jumpMultiplierPerBlock — are set by governance. Three of them are numbers someone chose. The fourth is a threshold someone chose.

The curve looks like price discovery. It is a policy. When utilization sits below the kink, borrowers pay a rate that was voted on. When it crosses the kink, the jump multiplier — another voted number — imposes a penalty designed to push utilization back down. This is a control loop. It is a well-designed control loop, and it has behaved reasonably for years. But it is not a market, and the interface that renders it as a smooth equilibrium is telling a story the contract never claimed.

Aave's model is structurally the same. A base variable borrow rate, two slopes, an optimal utilization ratio, all parameters recommended by paid risk providers and enacted by governance. The recommendations are competent. They are also a quarterly editorial judgment about what borrowers should pay, dressed as a rate.

Here is why this matters for provenance. If the rate is a governance parameter, then the correct question is not "what is the market rate?" It is "who set this, when, with what analysis, and can I read the proposal?" That is a sourceable question. It has a forum post, a Snapshot vote, an on-chain transaction, and a diff. Vested interest distorts the lens of analysis, and paid risk providers are a vested interest. But at least the record exists. The failure is not dishonesty. The failure is that nobody reads the record, because the chart is easier.

Now the sequencer.

Every major rollup in production today has one sequencer, operated by the company that built it. That node receives transactions, orders them, assigns them a position in a block, and posts the batch to L1. It also, in most deployments, sets the fee and decides which transactions to include.

The decentralization story has a real component and a rhetorical component. The real component is the forced-inclusion path. A user can submit a transaction directly to the L1 inbox, and after a delay — typically on the order of a day — the sequencer must include it or the chain halts. That is a censorship escape hatch. It is not decentralization. It is a fire exit that works if you are willing to wait a day and pay L1 gas.

"Decentralized sequencing" has been in specification documents for over two years across multiple teams. Shared sequencer networks, based sequencing, leader election with a stake. The designs are published and readable. Almost none of it runs in production on the rollups that carry the volume.

The provenance consequence is direct. An L2 has a credible data availability story and an incredible ordering story. Any attestation, any oracle update, any governance message that lives on that L2 inherits the ordering. If one operator can reorder, it can front-run. It can sandwich. In the limit, it decides which truths get sequenced first. To own the chain is to own the history. On an L2, one company owns the history, and the interface will show you a finality badge anyway.

Then the label.

In 2025 the phrase "Bitcoin Layer2" became a category. Most of what sits inside it is an EVM chain with a multisig bridge holding wrapped BTC. The security model is the bridge and its signers. Bitcoin provides settlement for a peg that a handful of keys control. That is a real architecture. It is simply not the architecture the label asserts.

The honest cases are worth arguing about on technical grounds. Rootstock with merge-mining. Stacks with proof-of-transfer. Citrea with a zk proof system anchored to Bitcoin. Each of these can be examined, challenged, and compared. The rest are Ethereum projects with an orange logo, and the Bitcoin developer community — the people who actually maintain consensus — does not accept the label. A label is a claim without an attestation.

So what actually exists to fix this? Three things, in ascending order of how much they prove.

Attestation registries. The Ethereum Attestation Service and its imitators let a party publish a structured claim — a schema, a set of fields, an attester address, a timestamp, a revocation flag — and let anyone else resolve it by UID. Schemas are registered on-chain, so a verifier can check that an attestation conforms to an expected shape before reading it. The verification code is trivial.

bytes32 constant DATASET_SCHEMA =
    0x8f0a1c...; // bytes32 datasetHash, address curator, uint64 attestedAt

Attestation memory a = eas.getAttestation(uid); require(a.schema == DATASET_SCHEMA, "wrong provenance domain"); require(a.revocationTime == 0, "attestation revoked"); require(a.expirationTime > block.timestamp, "attestation expired"); require(a.attester == expectedCurator, "unexpected attestor"); ```

That is cheap. It is also entirely agnostic about whether the attester knew anything. The registry proves form, not substance. Which is precisely the property the empty schema in my pipeline lacked. You cannot compose, revoke, or challenge a document with null fields. You can only believe it or discard it.

Transport proofs. The zkTLS family — DECO's descendants, TLSNotary, and the production systems built on them — proves that a specific HTTPS response came from a specific server, without requiring the verifier to trust the prover. For provenance of real-world data, whether that is an exchange balance, a bank statement, or a dataset licensing page, this is the most interesting primitive shipped in years.

Data availability sampling. Celestia and EigenDA prove that a blob of data was published and is retrievable. This is essential and it is frequently oversold. Proving that data was published is not proving that the data was true. The sampling guarantee is about availability, and availability is a precondition for verification, not a substitute for it.

And the fourth case. If a model is trained on a corpus, the corpus can be hashed, the hash can be attested, the attestation can be bonded, and the bond can be slashed if the corpus turns out to include data that was never licensed. I co-authored a specification along these lines last year, and the incentive design took six months longer than the cryptography. That is normal. The cryptography is the easy half.

The pattern across all four domains is the same. The chain can hold a hash. It cannot hold a judgment. Every provenance system terminates in a human or a machine that looked at something and decided to attest. Silence before the block confirms the truth — and the block confirms nothing about the silence.

Here is the uncomfortable part.

Attestation is not truth. It is chain of custody. A perfect chain of custody for a false statement produces a false statement with a good receipt, and receipts are what markets price.

Every permissionless attestation registry is a Sybil surface. A thousand attestations from a thousand fresh addresses cost less than a coffee on most L2s. Schema registration is permissionless by design, which means the "verified" badge becomes a purchasable asset. Watch any marketplace that adds a checkmark. Within a quarter, the checkmark is either gamed or abandoned.

The zkTLS notary model deserves the same suspicion. If a notary's signing key leaks, every proof it ever issued remains cryptographically valid and becomes semantically false, retroactively, with no way to distinguish the good proofs from the bad. That is trusted hardware wearing a new name. The improvement over a centralized API is real. It is not absolute.

There is also a cost argument the provenance maximalists skip. Making everything provable makes everything slower and more expensive. Some claims do not merit the overhead of a bonded attestation, and a forest of green checkmarks that nobody reads is not a healthier information environment than a dashboard that nobody reconciles. Certainty is a bug in a stochastic world. The goal was never certainty. It was falsifiability — the ability for a stranger to say "this is wrong, and here is the hash that shows it."

Watch the schema registries, not the marketing pages. The metric that will separate this cycle's infrastructure from its noise is not total value locked, and it is not transaction count. It is how many of a protocol's central claims resolve to a UID that a stranger can independently fetch, check, and revoke.

We build in the dark to light the public square. The systems that survive the next drawdown will be the ones whose claims can be reconstructed from first principles by someone with no position and no patience for narrative. The rest will keep rendering perfectly.