Research methods
From lead to finding: a claim ladder for crypto research
Match the strength of the language to the strength of the evidence.
Les enquêtes et les fiches de référence sont publiées en anglais. La navigation est disponible en sept langues.
Dans cet article
- Begin with the narrow fact A transaction happened, a permission exists or an interface produced a particular request. Record that fact without inserting motive. Then state the hypothesis that makes it relevant and the test that could distinguish it from another explanation.
- Test within the authorised scope A security finding should specify prerequisites, affected components and demonstrated impact. Technical testing guidance emphasises planning and scope; a research question does not itself authorise access to someone else's systems or funds. Preserve a reproducible account of the controlled test.
- Calibrate the published conclusion A capability is not proof of abuse. A common counterparty is not proof of common ownership. A private complaint is not an adjudicated fact. These distinctions do not weaken a report; they keep its strongest evidence from being undermined by an unsupported leap. When new evidence changes the conclusion, update the claim at the correct level and explain the change.
This editorial framework separates 4 stages: an observed fact, a working hypothesis, a tested finding and a broader conclusion. It is a practical way to keep an investigation useful when the evidence arrives unevenly.
Begin with the narrow fact A transaction happened, a permission exists or an interface produced a particular request. Record that fact without inserting motive. Then state the hypothesis that makes it relevant and the test that could distinguish it from another explanation.
Test within the authorised scope A security finding should specify prerequisites, affected components and demonstrated impact. Technical testing guidance emphasises planning and scope; a research question does not itself authorise access to someone else's systems or funds. Preserve a reproducible account of the controlled test.
Calibrate the published conclusion A capability is not proof of abuse. A common counterparty is not proof of common ownership. A private complaint is not an adjudicated fact. These distinctions do not weaken a report; they keep its strongest evidence from being undermined by an unsupported leap. When new evidence changes the conclusion, update the claim at the correct level and explain the change.
Sources
NIST publication · finalTechnical reference checked 9 September 2026. The review questions are editorial analysis, not findings about a named project.