Which tool answers which question
The most transferable page in this handbook
Every specific fact in Weeks 1–3 will eventually age. Chains change, protocols die, standards get superseded.
This does not. If you leave the Academy with one thing, make it the ability to investigate something you have never heard of and reach a defensible view.
Week 0 Part 3 introduced the tools. This is the workflow — which source fits which question, and how to cross-check.
Learning objectives
- Match a question type to the right class of source
- Apply the five-source model to an unfamiliar protocol
- Explain what each source can show, and what it still cannot tell you
- Recognise when you have enough to conclude, and when you do not
Core
Five source types
Week 0 introduced a five-part model. Week 4 turns it into a workflow. Start with the source that fits the question, then cross-check before concluding.
| Source type | Examples | Best for | Limits |
|---|---|---|---|
| Primary sources | Docs, GitHub, governance forums | Intended design, code and proposals | May describe plans rather than current practice |
| Direct chain records | Explorers, transactions and state | What happened on-chain | Usually cannot explain intent |
| Derived analytics | Dune, DefiLlama | Interpreted activity and comparisons | Definitions, queries and labels shape the result |
| Independent research | L2BEAT, Messari, audits | Risk analysis and comparison | Scope, authorship and incentives matter |
| Current discussion | X, Discord, Telegram, news | Discovery and context | Useful leads, not final proof |
Beginners often start with current discussion and stop there
Because it is the loudest, fastest and most confident-sounding layer. It is also the least verified.
Use social media for discovery, not as final evidence for an important claim. X is excellent for finding out that something happened. It is a poor place to confirm it happened the way someone says.
Question → source
The practical version. Match the question type, not the tool's popularity.
| Your question | Go to | Not to |
|---|---|---|
| What does it claim to do? | Official docs | X threads |
| How is it actually built? | GitHub | Marketing site |
| Who can change or upgrade it? | Docs, governance forum, L2BEAT for L2s | Assumptions |
| Did this transaction happen? | Etherscan | Anyone's screenshot |
| Is the contract verified? | Etherscan Contract tab | The team's word |
| How much value is in it? | DefiLlama | The project's own dashboard |
| Is anyone actually using it? | Dune | Follower counts |
| How does it compare to peers? | DefiLlama, Messari | A comparison the project made |
| What was decided, and by whom? | Governance forum, Snapshot | A summary tweet |
| What is happening right now? | X, Discord | — this is the one place it wins |
L2BEAT
Etherscan
DefiLlama
Dune
Messari
SnapshotThe single most useful habit
When someone makes a claim about a protocol, ask yourself: which row of that table would settle this?
Usually one would, in under five minutes. Most disagreements online are between people who have not opened it.
What each source type can and cannot tell you
Docs, GitHub, governance forums, the protocol's own writing.
Can tell you: the intended design, how upgrades work, who holds admin keys, what the team is actually building, what has been proposed and argued.
Cannot tell you: whether any of it is true in practice, or whether anyone uses it.
GitHub is underrated as a research tool
Commit frequency, open issues, and who is contributing tell you more about a project's health than any announcement. A protocol whose repository has been quiet for eight months is telling you something.
Etherscan and other block explorers.
Can tell you: what actually happened on-chain. Transactions, state, whether a contract is verified, and who deployed it.
Cannot tell you: why. On-chain data has no intent. A spike in addresses may be adoption or one person with a script.
Use the source that fits the claim
If a project claims growth and the chain records a different pattern, the direct record is an important check on the claim. Derived analytics are useful for patterns, but their definitions and queries still need checking.
Dune and DefiLlama.
Can tell you: useful interpretations of on-chain activity, such as trends, flows, protocol comparisons and dashboards.
Cannot tell you: a definition-free version of the truth. Check the query, schema, labels and methodology behind the number.
Messari, L2BEAT, institutional research.
Can tell you: a considered analysis by someone who spent longer than you, with framing and comparison you would take hours to build.
Cannot tell you: anything you should accept unexamined. Research has authors, audiences and sometimes sponsors. Check what is being compared and how terms are defined — "TVL" means different things on different sites.
X, Discord, Telegram, news.
Can tell you: that something is happening, what the current narrative is, what critics are saying, where to look next.
Cannot tell you: whether any of it is accurate.
Two specific traps
"FUD" is the standard reply to inconvenient evidence. Notice when criticism is being dismissed rather than answered.
"DYOR" and "NFA" cluster around the claims that deserve the most scrutiny — Week 0 Part 2 flagged this. They are disclaimers, not evidence.
When have you done enough?
You do not need certainty. You need a defensible view.
A reasonable stopping point
- You can state what it does in your own words
- You have cross-checked the key claim with another source type that actually fits the question
- You can name one thing that would change your mind
- You can say what you still do not know
Points 3 and 4 are what separate research from advocacy. Anyone can accumulate supporting evidence.
Landscape
- Dune dashboards — mostly community-built. Check the query before trusting the chart, because a different definition can change the result
- TVL definitions — differ by site, and double-counting is common. The same deposits can look different across dashboards
- Token unlock schedules — future supply becoming eligible to enter the market. A large unlock can create selling pressure, but eligibility is not the same as an actual sale
- Nansen, Arkham — tools for wallet labelling and entity attribution. Labels are useful clues, not proof that an address belongs to a person or company
- Etherscan Token Approvals — a way to audit your own permissions. Revoking an allowance reduces one exposure but does not undo past transfers
- Governance forums — often the most honest writing about a protocol's problems. Read the objections as well as the proposal
- Audit reports — usually public reviews of a defined scope. Read the findings and unresolved issues, not just the fact that an audit happened
Worked example
"This new lending protocol has $400M TVL and is completely safe."
Two claims. Both checkable in about ten minutes.
Does the $400M exist?
DefiLlama — find the protocol, check TVL and its trend. A number that appeared last week behaves differently from one built over a year.
Where did it come from?
Dune — how many unique depositors? $400M from 30 addresses is a very different fact from $400M from 30,000, and both round to "$400M TVL".
What can go wrong?
Docs and GitHub — is it audited, and by whom? Which oracle does it use? Who can upgrade the contracts? Week 3 Part 5 gave you the vocabulary for all three.
Who controls it?
Governance forum and the contract's admin functions on Etherscan. A multisig that can upgrade the contracts is the single most important fact most people never check.
What are people saying?
X and Discord — last, for context and for critics you had not thought of.
On "completely safe"
Week 2 Part 6 already answered this. Nothing with contracts, an oracle and an upgrade key is "completely safe" — the useful question is what has to hold, and who has to behave.
If someone cannot answer that about their own protocol, that is itself a finding.
A defensible conclusion sounds like this:
"TVL is real and roughly $400M, but 60% sits with eight addresses, so it is concentrated. Audited by one firm in March; the oracle is Chainlink; a 3-of-5 multisig can upgrade the contracts, which is the main risk I would want to understand better. I have not verified who holds those keys."
Note what it does: names the evidence, quantifies where it can, states the main risk, and admits what is unknown. That is what Researcher Deep Dive work will practise, and it is what the Anchor Mission is asking you to start doing.
Further exploration — optional, not assessed
- Messari Research — read one report and notice its structure. Professional research has a shape worth copying
- L2BEAT — the clearest public writing on trust assumptions anywhere
- Dune — open a dashboard and read the SQL. You will never trust a chart the same way again
- Pick a protocol you already like and try to build the bear case using only primary sources