From lead to finding: a claim ladder for crypto research

This editorial framework separates 4 stages: an observed fact, a working hypothesis, a tested finding and a broader conclusion. It is a practical way to keep an investigation useful when the evidence arrives unevenly.

Begin with the narrow fact A transaction happened, a permission exists or an interface produced a particular request. Record that fact without inserting motive. Then state the hypothesis that makes it relevant and the test that could distinguish it from another explanation.

Test within the authorised scope A security finding should specify prerequisites, affected components and demonstrated impact. Technical testing guidance emphasises planning and scope; a research question does not itself authorise access to someone else's systems or funds. Preserve a reproducible account of the controlled test.

Calibrate the published conclusion A capability is not proof of abuse. A common counterparty is not proof of common ownership. A private complaint is not an adjudicated fact. These distinctions do not weaken a report; they keep its strongest evidence from being undermined by an unsupported leap. When new evidence changes the conclusion, update the claim at the correct level and explain the change.