Crypto OS
Non-Technical Crypto OSStage 4 · Tokens, Markets, and Research

Chapter 23 · Using On-Chain Data to Observe Reality

How can you see what is happening without relying on others' conclusions?

Capabilities practiced
Onchain LiteracyResearch
Hands on
Make your first chart on an on-chain data platform: a protocol's revenue and active addresses over the last 90 days.
AI Lab
Have AI specify the data extraction rules and query. Run it yourself and check whether it counts incentives as revenue.

A Real-World Problem

You have three reports about one protocol.

Its quarterly report claims $24 million in revenue. An independent researcher reports $9 million for the same quarter. A social-media spreadsheet reports an $18 million net loss.

Same protocol and period, dramatically different numbers and signs.

You suspect dishonesty. But investigation reveals every figure can be matched to actual on-chain transactions.

They answer different questions:

  • Total fees paid by users.
  • The share retained by the protocol.
  • Net income after token incentives.

All can be correct because nobody defined revenue.

Data is public; definitions are private.

Public transactions are a powerful advantage, but raw facts are not conclusions. Which transactions you include determines the result.

Reports often omit that choice.

This chapter teaches how to start from raw facts and produce a number you can defend.

It is among Part A's most practical chapters and central to capstone research.

Thought Experiment

Consider a coffee shop rather than a blockchain.

It sells through a delivery platform. Last month's accounts:

  • Customers paid one million.
  • The platform retained 20%, or 200,000.
  • The shop issued 150,000 in vouchers for acquisition.
  • It printed vouchers at almost no cost.

What was its revenue?

Five defensible answers:

A  1,000,000  Total customer payments
B    800,000  Receipts after platform fees
C    650,000  Less voucher face value
D    800,000  Self-printed vouchers involved no cash outflow
E    650,000  Future coffee redemption creates real costs

Do vouchers count as a cost?

Cash accounting this month might exclude them; longer-term obligations include them.

Protocol-token incentives pose the same question. No cash leaves immediately, but issuance dilutes holders. Inclusion depends on the question.

Two more distinctions.

Money held is not money earned.

A safe contains five million, of which 4.8 million is prepaid customer balances, withdrawable anytime. The impressive balance belongs mostly to customers.

An on-chain metric measures this safe, often cited as protocol scale despite representing others' deposits.

Visitor counts also need definition.

There were 6,000 visits, including 4,500 voucher collections without full-price purchases. The remaining 1,500 visits came from 300 people visiting five times.

The headline might mean 6,000 visits, 1,800 unique people, 300 repeat customers, or 1,500 genuine purchases. All describe different things.

Replace customers with addresses and the same issues appear. On-chain records let you count directly.

Your Decision

You want last month's protocol earnings. Where do you begin?

What Happens

The options agree:

Definition is harder than extraction.

A correct query can retrieve 90 days in seconds. Six choices require the real work:

Definition questionDecision
Which addresses?Main contract, all versions, all chains, proxy or implementation
Which events?Usage types, failed transactions, internal transfers
Gross or net?All user payments or protocol-retained share
Incentives?Cost inclusion and valuation method
Time boundaries?Calendar month or rolling days, block time or UTC
Deduplication?Addresses or people, custodians and multi-address users

Any changed answer changes the number, yet many reports disclose none.

One protocol can legitimately produce:

MetricMeasuresCommon misuse
Total user feesAll user paymentsCalled protocol revenue
Protocol shareFees after provider distributionsOmitted, inflating earnings
Net revenueAfter incentivesMissing from promotion
Locked valueOthers' depositsTreated as protocol value
VolumeFunds passing throughTreated as demand despite wash trading
Active addressesInteracting addressesTreated as users

Assign every number to a row before using it.

Also identify circulating capitalization versus FDV whenever citing valuation. Chapter 19 showed they can differ tenfold; unidentified defaults invalidate comparisons.

Build a Model

Six steps, each with a deliverable:

  1. Define the question
  2. Define the metric
  3. Choose sources
  4. Extract data
  5. Cross-check
  6. State uncertainty
Starting at extraction produces fragile conclusions. The first two steps take little time but determine the rest's value.

The steps in detail:

StepDeliverableWithout it
1Falsifiable question with time rangeEndless unfocused research
2Written answers to all six definitionsUninterpretable, irreproducible figures
3At least two independent sourcesUndetected source errors
4Reproducible query or procedureRepeating work next month
5Differences and explanationsLosing informative discrepancies
6Explicit uncertainty listReaders cannot judge confidence

Cross-checking means explaining disagreement, beyond finding agreement.

A 3% gap may reflect boundaries; 40% likely reflects scope. Finding that difference reveals protocol structure. Discrepancies are information.

Honest uncertainty might include missing chains, price-sensitive incentive valuation, or unresolved address ownership. This separates research from promotion.

Analysis that states its blind spots is more credible than apparently flawless analysis.

Keep this metric table for capstone work:

MetricActual meaningTrap
HoldersAddresses holding a tokenAddresses differ from people and custodians
TVLAssets depositedCustomer assets, repeated counting, price-driven growth
FeesTotal user paymentMuch may go to LPs
RevenueProtocol-retained shareIncentive inclusion varies
NetflowInflows minus outflowsInternal and market-maker movements distort it
Open interestOutstanding derivativesDenomination and venue scope differ; no direction implied

What It Is Called

HolderHolder

Addresses holding a token.

Addresses, not people: many per person or many people per custodian.

Separate recent interacting addresses, one-time recipients, and creation dates, as in Chapter 22.

Total Value LockedTVL / Total Value Locked

The value deposited in protocol contracts.

It belongs to users. Rising asset prices can imitate growth; composability can count one capital pool repeatedly.

Useful for scale, not income or intrinsic value. Chapter 26 emphasizes this.

FeesFees

Total user payments for protocol services.

Ask where the money ends. Trading protocols often distribute most to liquidity providers.

Equating fees with revenue commonly exaggerates earnings.

RevenueRevenue

The protocol's retained fee share.

Subtract incentives for net revenue, distinguishing earnings from spending on acquisition.

Specify which layer you quote.

NetflowNetflow

Inflows minus outflows for a defined address group and period.

Exchange analysis is distorted by internal wallet reorganizations, market-maker adjustments, and hot/cold transfers.

Verify address classification before netflow analysis.

Open InterestOpen Interest

Outstanding derivative contracts, used in Chapters 18 and 21.

Check denomination and venue coverage. Dollar and coin curves may diverge.

It measures leverage scale without directional information.

Hands-on

Hands onBuild your first on-chain data chartSQL-capable on-chain data platform and block explorerUsually free within platform allowances; research only

Chart 90 days of revenue and active addresses, defending every number.

This longer Lab can be split into two sessions.

Choose a protocol and write the question.

Use a clear fee model in an exchange, lending system, or perpetual platform, avoiding excessive complexity.

For example: daily protocol revenue and distinct interacting addresses over the last 90 days.

Keep the question at the document's top and refer back to it.

Write all six definitions.

Do not skip the core step.

Addresses: main contract 0x… verified on-chain, mainnet only;
           missing other chains appears in the uncertainty list
Events: Swap / Borrow / …; failed transactions excluded
Gross/net: protocol share = total fees × protocol allocation ratio
           cite parameter name and current value
Incentives: excluded from revenue here, plotted separately as spending
Time: UTC calendar days, most recent 90 complete days
Deduplication: from address; no person-level merging, stated as a limitation

Verify official contract addresses in an explorer.

Check proxy status, newer versions, and recent activity rather than copying articles.

Inspect a transaction's events and fields. Those events are the query inputs.

First query: daily fees.

Platform tables differ, but the structure is:

select
  date_trunc('day', block_time) as day,
  sum(fee_amount_usd)           as fees_usd,
  count(*)                      as tx_count
from <platform_event_table>
where contract_address = <verified_contract_address>
  and block_time >= now() - interval '90' day
group by 1
order by 1

Start with three days. Compare with explorer transactions and resolve scale discrepancies before proceeding.

Second query: daily active addresses.

select
  date_trunc('day', block_time)  as day,
  count(distinct tx_from)        as active_addresses
from <platform_event_table>
where contract_address = <contract_address>
  and block_time >= now() - interval '90' day
group by 1
order by 1

tx_from may identify an aggregator or contract wallet rather than the end user. Inspect real transactions to identify the layer you count.

Plot revenue bars and address lines with two axes.

Inspect divergence: revenue jumps without address growth may indicate large trades; address jumps without revenue may indicate incentives or automation.

Investigate one divergent day through its underlying transactions.

Cross-check 90-day totals against the official dashboard and a third-party platform.

Use:

Source90-day figureDifference from mineExplanation
My query——
Official dashboard
Third-party platform

The final column is the key output. Unexplained gaps over 20% suggest incomplete definitions.

List at least three uncertainties: omitted chains, aggregator attribution, or incentive price valuation, for example.

You now have a chart, reproducible query, and honest blind-spot list.

Together they form a minimum unit of primary research. Chapters 26 and 31 build on it, and capstones repeat it.

AI Lab

AI LabAsk AI for definitions and queries, then run them and catch scope errorsLevel 2 · AI Copilot

Complete the manual Lab first so you can assess the output.

Request:

I need protocol revenue and daily active addresses over 90 days.

First define scope, before writing SQL:
1. Contracts by chain
2. Events and failed-transaction handling
3. Gross user fees or protocol net share, and allocation parameters
4. Incentive costs and conversion price
5. Time boundaries
6. Address deduplication and aggregators

Then write a query with actual table and field names.
Finally list uncovered activity and possible under/overestimates.

Cite every address, parameter, and event.
Mark uncertainty "requires manual verification" rather than invent values.

Verify addresses and events first, then run the query.

Five frequent errors, ordered by danger:

  1. Incentives mistaken for income or omitted as costs.
  2. Fees mistaken for revenue, multiplying results.
  3. Invented addresses or fields, syntactically plausible but nonexistent.
  4. Mixed valuation definitions, especially capitalization and FDV.
  5. Missing chains and versions, systematically understating activity.

Record actual errors. Human reports share these failures too.

Compare your written scope with the model's: what did each catch or omit? Chapter 31 turns this into a workflow.

Verify these points yourself after using AI

  • Are contract addresses verified, current, and correctly identified as proxies?
  • Do event and field names exist in real transactions?
  • Does it distinguish user fees from protocol revenue?
  • Does it confuse incentives with revenue or ignore incentive spending?
  • Does it identify market cap versus FDV?
  • What time field and boundary rules does it use?
  • Which field identifies active addresses, and how are aggregators handled?
  • Does it list excluded coverage?

Real-World Case

Three revenue figures for one protocolVerifiable anytime

Any incentive-paying protocol can report total fees, retained revenue, and incentive-adjusted net income.

They may differ tenfold, with net income negative.

Each has a purpose: usage scale, business model, or growth spending. Explicit definition matters more than selecting one universal number.

Repeated counting of locked valueCommon in composable protocols

Deposit funds, collateralize the receipt elsewhere, and redeposit borrowed funds into a third protocol.

One original capital pool appears in three TVL totals.

This follows composability rather than fraud, but aggregate TVL systematically expands with layering, reflecting Chapter 21's leverage loop in data.

The week active addresses multipliedIncentive campaigns

A campaign raises addresses more than tenfold and is promoted as growth.

Most new addresses cluster around the campaign, perform minimum qualifying actions, then vanish.

Creation-time distributions and 30-day retention verify this. Chapter 28 formalizes the test.

Sources that disclose definitionsAn improving industry practice

Some data projects open-source fee allocation, incentive treatment, and parameter selection.

Debate can target definitions rather than unexplained numbers, identifying exact query differences.

First ask where the methodology is documented. Authority alone does not replace it.

Change One Variable

What ifThe protocol runs on five chains but you count only mainnet

Figures understate totals, with changing bias as activity migrates, potentially creating false decline.

Either clearly label mainnet-only scope or cover every chain.

Do not describe one-chain results as the whole protocol.

What ifToken incentives are costs valued at daily closing prices

Revenue may turn negative, and its shape becomes sensitive to token prices.

Higher prices raise dollar-valued incentive cost, lowering net income; lower prices reverse that.

Show dollar and token-unit series together. Expose the definition's effects openly.

What ifHalf the users access through aggregators

Transaction-origin counts can group those users into a few intermediary addresses.

Internal-call analysis may recover deeper attribution on suitable platforms but adds complexity.

If unavailable, disclose the limitation. Knowing omissions is essential.

What ifYou need real people rather than addresses

Reliable counting generally cannot be achieved from chains alone.

Funding clusters, behavioral grouping, and off-chain identity can approximate it but add error and conflict with privacy.

Use a measurable alternative: recently active addresses not batch-created within one hour.

Replace unanswerable questions with answerable ones and disclose the change.

Takeaway Questions

4
Who is the user?

Do not accept user counts without examining what they include.

Disaggregate users into active addresses, distinct addresses, paying addresses, and 30-day post-campaign survivors. Chapter 28 formalizes this.

5
Who is paying?

Trace payer addresses, contracts, and recipients.

New protocol tokens are ultimately paid for by holder dilution, requiring contract inspection to distinguish them from genuine receipts.

6
Where does revenue come from?

Separate total fees, protocol share, and incentive-adjusted net income.

Identify the layer whenever quoting revenue, making analysis easier to defend.

12
Will users remain when subsidies stop?

Measure campaign entrants' retention 30, 60, and 90 days after incentives end.

The resulting facts answer the question directly, rather than relying on opinions.

Chapter Check

Key idea

On-chain data is one of the few first-hand facts in this industry that you can verify yourself.

Finished this chapter’s lab? Mark it completeView all progress

On this page