Chapter 23 · Using On-Chain Data to Observe Reality
How can you see what is happening without relying on others' conclusions?
- Capabilities practiced
- Onchain LiteracyResearch
- Hands on
- Make your first chart on an on-chain data platform: a protocol's revenue and active addresses over the last 90 days.
- AI Lab
- Have AI specify the data extraction rules and query. Run it yourself and check whether it counts incentives as revenue.
A Real-World Problem
You have three reports about one protocol.
Its quarterly report claims $24 million in revenue. An independent researcher reports $9 million for the same quarter. A social-media spreadsheet reports an $18 million net loss.
Same protocol and period, dramatically different numbers and signs.
You suspect dishonesty. But investigation reveals every figure can be matched to actual on-chain transactions.
They answer different questions:
- Total fees paid by users.
- The share retained by the protocol.
- Net income after token incentives.
All can be correct because nobody defined revenue.
Data is public; definitions are private.
Public transactions are a powerful advantage, but raw facts are not conclusions. Which transactions you include determines the result.
Reports often omit that choice.
This chapter teaches how to start from raw facts and produce a number you can defend.
It is among Part A's most practical chapters and central to capstone research.
Thought Experiment
Consider a coffee shop rather than a blockchain.
It sells through a delivery platform. Last month's accounts:
- Customers paid one million.
- The platform retained 20%, or 200,000.
- The shop issued 150,000 in vouchers for acquisition.
- It printed vouchers at almost no cost.
What was its revenue?
Five defensible answers:
A 1,000,000 Total customer payments
B 800,000 Receipts after platform fees
C 650,000 Less voucher face value
D 800,000 Self-printed vouchers involved no cash outflow
E 650,000 Future coffee redemption creates real costsDo vouchers count as a cost?
Cash accounting this month might exclude them; longer-term obligations include them.
Protocol-token incentives pose the same question. No cash leaves immediately, but issuance dilutes holders. Inclusion depends on the question.
Two more distinctions.
Money held is not money earned.
A safe contains five million, of which 4.8 million is prepaid customer balances, withdrawable anytime. The impressive balance belongs mostly to customers.
An on-chain metric measures this safe, often cited as protocol scale despite representing others' deposits.
Visitor counts also need definition.
There were 6,000 visits, including 4,500 voucher collections without full-price purchases. The remaining 1,500 visits came from 300 people visiting five times.
The headline might mean 6,000 visits, 1,800 unique people, 300 repeat customers, or 1,500 genuine purchases. All describe different things.
Replace customers with addresses and the same issues appear. On-chain records let you count directly.
Your Decision
You want last month's protocol earnings. Where do you begin?
What Happens
The options agree:
Definition is harder than extraction.
A correct query can retrieve 90 days in seconds. Six choices require the real work:
| Definition question | Decision |
|---|---|
| Which addresses? | Main contract, all versions, all chains, proxy or implementation |
| Which events? | Usage types, failed transactions, internal transfers |
| Gross or net? | All user payments or protocol-retained share |
| Incentives? | Cost inclusion and valuation method |
| Time boundaries? | Calendar month or rolling days, block time or UTC |
| Deduplication? | Addresses or people, custodians and multi-address users |
Any changed answer changes the number, yet many reports disclose none.
One protocol can legitimately produce:
| Metric | Measures | Common misuse |
|---|---|---|
| Total user fees | All user payments | Called protocol revenue |
| Protocol share | Fees after provider distributions | Omitted, inflating earnings |
| Net revenue | After incentives | Missing from promotion |
| Locked value | Others' deposits | Treated as protocol value |
| Volume | Funds passing through | Treated as demand despite wash trading |
| Active addresses | Interacting addresses | Treated as users |
Assign every number to a row before using it.
Also identify circulating capitalization versus FDV whenever citing valuation. Chapter 19 showed they can differ tenfold; unidentified defaults invalidate comparisons.
Build a Model
Six steps, each with a deliverable:
- Define the question
- Define the metric
- Choose sources
- Extract data
- Cross-check
- State uncertainty
The steps in detail:
| Step | Deliverable | Without it |
|---|---|---|
| 1 | Falsifiable question with time range | Endless unfocused research |
| 2 | Written answers to all six definitions | Uninterpretable, irreproducible figures |
| 3 | At least two independent sources | Undetected source errors |
| 4 | Reproducible query or procedure | Repeating work next month |
| 5 | Differences and explanations | Losing informative discrepancies |
| 6 | Explicit uncertainty list | Readers cannot judge confidence |
Cross-checking means explaining disagreement, beyond finding agreement.
A 3% gap may reflect boundaries; 40% likely reflects scope. Finding that difference reveals protocol structure. Discrepancies are information.
Honest uncertainty might include missing chains, price-sensitive incentive valuation, or unresolved address ownership. This separates research from promotion.
Analysis that states its blind spots is more credible than apparently flawless analysis.
Keep this metric table for capstone work:
| Metric | Actual meaning | Trap |
|---|---|---|
| Holders | Addresses holding a token | Addresses differ from people and custodians |
| TVL | Assets deposited | Customer assets, repeated counting, price-driven growth |
| Fees | Total user payment | Much may go to LPs |
| Revenue | Protocol-retained share | Incentive inclusion varies |
| Netflow | Inflows minus outflows | Internal and market-maker movements distort it |
| Open interest | Outstanding derivatives | Denomination and venue scope differ; no direction implied |
What It Is Called
Addresses holding a token.
Addresses, not people: many per person or many people per custodian.
Separate recent interacting addresses, one-time recipients, and creation dates, as in Chapter 22.
The value deposited in protocol contracts.
It belongs to users. Rising asset prices can imitate growth; composability can count one capital pool repeatedly.
Useful for scale, not income or intrinsic value. Chapter 26 emphasizes this.
Total user payments for protocol services.
Ask where the money ends. Trading protocols often distribute most to liquidity providers.
Equating fees with revenue commonly exaggerates earnings.
The protocol's retained fee share.
Subtract incentives for net revenue, distinguishing earnings from spending on acquisition.
Specify which layer you quote.
Inflows minus outflows for a defined address group and period.
Exchange analysis is distorted by internal wallet reorganizations, market-maker adjustments, and hot/cold transfers.
Verify address classification before netflow analysis.
Outstanding derivative contracts, used in Chapters 18 and 21.
Check denomination and venue coverage. Dollar and coin curves may diverge.
It measures leverage scale without directional information.
Hands-on
Chart 90 days of revenue and active addresses, defending every number.
This longer Lab can be split into two sessions.
Choose a protocol and write the question.
Use a clear fee model in an exchange, lending system, or perpetual platform, avoiding excessive complexity.
For example: daily protocol revenue and distinct interacting addresses over the last 90 days.
Keep the question at the document's top and refer back to it.
Write all six definitions.
Do not skip the core step.
Addresses: main contract 0x… verified on-chain, mainnet only;
missing other chains appears in the uncertainty list
Events: Swap / Borrow / …; failed transactions excluded
Gross/net: protocol share = total fees × protocol allocation ratio
cite parameter name and current value
Incentives: excluded from revenue here, plotted separately as spending
Time: UTC calendar days, most recent 90 complete days
Deduplication: from address; no person-level merging, stated as a limitationVerify official contract addresses in an explorer.
Check proxy status, newer versions, and recent activity rather than copying articles.
Inspect a transaction's events and fields. Those events are the query inputs.
First query: daily fees.
Platform tables differ, but the structure is:
select
date_trunc('day', block_time) as day,
sum(fee_amount_usd) as fees_usd,
count(*) as tx_count
from <platform_event_table>
where contract_address = <verified_contract_address>
and block_time >= now() - interval '90' day
group by 1
order by 1Start with three days. Compare with explorer transactions and resolve scale discrepancies before proceeding.
Second query: daily active addresses.
select
date_trunc('day', block_time) as day,
count(distinct tx_from) as active_addresses
from <platform_event_table>
where contract_address = <contract_address>
and block_time >= now() - interval '90' day
group by 1
order by 1tx_from may identify an aggregator or contract wallet rather than the end user. Inspect real transactions to identify the layer you count.
Plot revenue bars and address lines with two axes.
Inspect divergence: revenue jumps without address growth may indicate large trades; address jumps without revenue may indicate incentives or automation.
Investigate one divergent day through its underlying transactions.
Cross-check 90-day totals against the official dashboard and a third-party platform.
Use:
| Source | 90-day figure | Difference from mine | Explanation |
|---|---|---|---|
| My query | — | — | |
| Official dashboard | |||
| Third-party platform |
The final column is the key output. Unexplained gaps over 20% suggest incomplete definitions.
List at least three uncertainties: omitted chains, aggregator attribution, or incentive price valuation, for example.
You now have a chart, reproducible query, and honest blind-spot list.
Together they form a minimum unit of primary research. Chapters 26 and 31 build on it, and capstones repeat it.
AI Lab
Complete the manual Lab first so you can assess the output.
Request:
I need protocol revenue and daily active addresses over 90 days.
First define scope, before writing SQL:
1. Contracts by chain
2. Events and failed-transaction handling
3. Gross user fees or protocol net share, and allocation parameters
4. Incentive costs and conversion price
5. Time boundaries
6. Address deduplication and aggregators
Then write a query with actual table and field names.
Finally list uncovered activity and possible under/overestimates.
Cite every address, parameter, and event.
Mark uncertainty "requires manual verification" rather than invent values.Verify addresses and events first, then run the query.
Five frequent errors, ordered by danger:
- Incentives mistaken for income or omitted as costs.
- Fees mistaken for revenue, multiplying results.
- Invented addresses or fields, syntactically plausible but nonexistent.
- Mixed valuation definitions, especially capitalization and FDV.
- Missing chains and versions, systematically understating activity.
Record actual errors. Human reports share these failures too.
Compare your written scope with the model's: what did each catch or omit? Chapter 31 turns this into a workflow.
Verify these points yourself after using AI
- Are contract addresses verified, current, and correctly identified as proxies?
- Do event and field names exist in real transactions?
- Does it distinguish user fees from protocol revenue?
- Does it confuse incentives with revenue or ignore incentive spending?
- Does it identify market cap versus FDV?
- What time field and boundary rules does it use?
- Which field identifies active addresses, and how are aggregators handled?
- Does it list excluded coverage?
Real-World Case
Any incentive-paying protocol can report total fees, retained revenue, and incentive-adjusted net income.
They may differ tenfold, with net income negative.
Each has a purpose: usage scale, business model, or growth spending. Explicit definition matters more than selecting one universal number.
Deposit funds, collateralize the receipt elsewhere, and redeposit borrowed funds into a third protocol.
One original capital pool appears in three TVL totals.
This follows composability rather than fraud, but aggregate TVL systematically expands with layering, reflecting Chapter 21's leverage loop in data.
A campaign raises addresses more than tenfold and is promoted as growth.
Most new addresses cluster around the campaign, perform minimum qualifying actions, then vanish.
Creation-time distributions and 30-day retention verify this. Chapter 28 formalizes the test.
Some data projects open-source fee allocation, incentive treatment, and parameter selection.
Debate can target definitions rather than unexplained numbers, identifying exact query differences.
First ask where the methodology is documented. Authority alone does not replace it.
Change One Variable
Figures understate totals, with changing bias as activity migrates, potentially creating false decline.
Either clearly label mainnet-only scope or cover every chain.
Do not describe one-chain results as the whole protocol.
Revenue may turn negative, and its shape becomes sensitive to token prices.
Higher prices raise dollar-valued incentive cost, lowering net income; lower prices reverse that.
Show dollar and token-unit series together. Expose the definition's effects openly.
Transaction-origin counts can group those users into a few intermediary addresses.
Internal-call analysis may recover deeper attribution on suitable platforms but adds complexity.
If unavailable, disclose the limitation. Knowing omissions is essential.
Reliable counting generally cannot be achieved from chains alone.
Funding clusters, behavioral grouping, and off-chain identity can approximate it but add error and conflict with privacy.
Use a measurable alternative: recently active addresses not batch-created within one hour.
Replace unanswerable questions with answerable ones and disclose the change.
Takeaway Questions
Do not accept user counts without examining what they include.
Disaggregate users into active addresses, distinct addresses, paying addresses, and 30-day post-campaign survivors. Chapter 28 formalizes this.
Trace payer addresses, contracts, and recipients.
New protocol tokens are ultimately paid for by holder dilution, requiring contract inspection to distinguish them from genuine receipts.
Separate total fees, protocol share, and incentive-adjusted net income.
Identify the layer whenever quoting revenue, making analysis easier to defend.
Measure campaign entrants' retention 30, 60, and 90 days after incentives end.
The resulting facts answer the question directly, rather than relying on opinions.
Chapter Check
They answer different questions:
- User fees measure activity scale.
- Protocol share measures monetization.
- Incentive-adjusted net income measures earnings versus growth spending.
Each reconciles with transactions. Unstated scope causes the confusion.
Cite figure, definition, timestamp, and source together.
No. It measures others' deposited assets.
Prices can inflate it, composability can repeat it, and users can withdraw much of it.
Treat it as a rough scale measure and calculate revenue separately, as Chapter 26 emphasizes.
Incentive treatment.
It occurs elsewhere from the revenue query, so ignoring it still produces attractive figures.
Heavy incentives can turn apparent profitable growth into net outflow. The interpretations can reverse.
Gross versus protocol-retained fees is another major source of inflation.
Their scale suggests different causes.
Small gaps often reflect timing, exchange rates, or omitted minor events.
Large gaps indicate scope differences. Explaining them reveals structure, sometimes more valuable than the number.
The goal is explaining disagreement, not forcing agreement.
Check:
- Falsifiable question with a time range?
- Definitions written, not merely considered?
- Addresses verified rather than copied?
- Cross-checks and explanations?
- At least three uncertainties?
- Reusable query next month?
Definition often takes longest. Skipping it creates repeated rework, rather than saving time.
Key idea
On-chain data is one of the few first-hand facts in this industry that you can verify yourself.