The N/A Problem: Why Empty Payloads Pass Every Oracle Check

The system returned nine dimensions. Every field was populated. Every table had rows. Every section carried a status label, a confidence rating, and an evidence line. And every value read: not applicable, insufficient information.

Nothing threw. No assertion failed. The schema was satisfied completely, and the payload carried nothing at all. A reader skimming the structure — comparison matrices, risk registers, a priority-ordered list of blockers — would reasonably have concluded that a rigorous assessment had taken place and had found nothing worth flagging.

This is not a story about a broken parser. It is a story about the distance between well-formed and true, and it is the distance that has drained more vaults than any reentrancy bug I have reviewed in eleven years. I spent a week asking why that empty report felt familiar. The answer is that I have seen that exact output before — on-chain, in production, with real collateral attached to it.

Silence before the breach.

The Shape of a Valid Nothing

Ethereum's execution environment has no concept of null. A function declared to return a struct returns a struct. If the underlying state is missing, unset, or never written, the EVM does not raise — it returns zeroed memory. uint256 becomes 0. int256 becomes 0. An address becomes 0x0000000000000000000000000000000000000000. The call succeeds. Gas is spent. The caller receives a perfectly well-formed value.

This is a deliberate design property, not a defect. Deterministic zero-initialisation is what allows state roots to be computed without ambiguity. But it means that every consumer of external data must independently encode the semantics of absence, because the transport layer will never do it for them.

Most do not. And the reason most do not is structural: the interfaces they build against were designed to make presence easy to express and absence impossible to express.

What the Interface Actually Returns

Consider the standard price feed interface that a large fraction of DeFi lending depends on:

function latestRoundData() external view returns (
    uint80 roundId,
    int256 answer,
    uint256 startedAt,
    uint256 updatedAt,
    uint80 answeredInRound
);

Five return values. None of them is a validity flag. There is no bool ok. There is no error enum. The contract either reverts — which is loud and therefore safe — or it returns five numbers, and the caller must decide whether those numbers mean anything.

updatedAt is the timestamp of the last oracle update. answeredInRound was intended to signal whether the answer was computed in the current round or carried forward from an earlier one; it has since been deprecated in favour of updatedAt, which is a cleaner signal but only if someone reads it. And answer is the price — or, on a feed that has never been written, 0.

A price of zero is not obviously wrong to a contract. It is a number. It propagates through a multiplication. In a lending market, a collateral price of zero means every position is insolvent and every liquidation is permitted. In a derivatives market, it means every position settles at zero. The contract behaved exactly as specified. The specification was the vulnerability.

Three Predicates, and the One Nobody Checks

The hardened pattern is well documented and rarely implemented in full. It requires four independent predicates, not one:

require(answer > 0)                          // A: semantic sanity
require(updatedAt > 0)                       // B: feed initialised
require(block.timestamp - updatedAt <= HEARTBEAT)  // C: not stale
if (sequencerDown) require(block.timestamp - startedAt > GRACE) // D: post-outage

| Predicate | What it catches | Typical implementation | Failure if omitted | |---|---|---|---| | A: answer > 0 | Uninitialised or zeroed feed | Common | Total insolvency cascade | | B: updatedAt > 0 | Feed never written | Uncommon | Predicate A passes on a real zero | | C: heartbeat | Stalled feed, sequencer stall | Inconsistent | Liquidations priced on yesterday's market | | D: uptime grace | Post-outage backlog flush | Rare outside Aave V3 | First-mover arbitrage on stale prices |

Predicate D is the one that matters most and appears least. When an L2 sequencer halts and restarts, the transaction queue does not replay at the same wall-clock time it was submitted. It replays in a burst — including oracle updates that were queued during the outage, and including liquidations that were queued behind them. The sequencer uptime feed exists precisely to make this window observable: it returns answer == 1 while the sequencer is down, and after restart, consumers are expected to impose a grace period — commonly 3,600 seconds in reference implementations — before trusting prices again.

The grace period is a deliberate freeze of the protocol's core function in order to prevent a worse outcome. It is an admission that for one hour after an L2 outage, the protocol cannot tell the difference between a fresh price and a well-formed zero. Most forks of major lending markets strip this check, because it blocks liquidations and liquidations are revenue.

The Blob That Was Available and Empty

The same pattern has migrated upward into the data availability layer, where it is harder to see and considerably more expensive to be wrong about.

EIP-4844 blobs are fixed-size: 4,096 field elements of 32 bytes, 131,072 bytes each, zero-padded to the boundary. A rollup posts a blob; the beacon chain commits to it via KZGCommitment; the execution layer exposes the versioned hash through BLOBHASH. Every one of those steps proves that bytes were published and are retrievable.

None of them proves the bytes mean anything.

A blob of 131,072 zero bytes is available. It is committed to. It passes every availability check the design specifies. If a rollup's batch encoder fails in a way that emits an empty batch — a deserialisation path that returns an empty vector rather than reverting — the settlement contract receives a valid commitment to a valid blob containing valid padded nothing. Availability is a transport property; validity is a semantic property; and the industry's vocabulary routinely conflates them.

This is why I have been unmoved by the proliferation of dedicated DA layers. If a rollup cannot produce enough data for Ethereum's blob capacity to bind — and the overwhelming majority cannot — then it is not purchasing security from a DA layer. It is purchasing a guarantee that bytes exist somewhere, from a committee, while its own encoder's edge cases go unaudited. Verification greater than reputation, as always.

The Twelve-Second Window

Earlier this year I completed a review of an AI-agent execution platform in which models were permitted to open and close positions autonomously against on-chain liquidity. The contracts were clean. The model integration was not.

The interface exposed a price to the agent through the standard five-value call. The agent's policy layer read answer and ignored updatedAt. The execution layer then applied a settlement delay — twelve seconds in the deployed configuration — between the agent's decision and the trade's inclusion. In eleven of eleven simulated volatility events, the agent acted on a price that was accurate at decision time and stale at settlement time. The gap was not exploited by an attacker; it was exploited by arithmetic.

My recommendation was a time-lock: reject any execution whose referenced price observation is older than the decision-to-settlement delta plus one heartbeat. Not a rate limit. Not a circuit breaker. A hard precondition on the age of the input, enforced at the contract boundary rather than in the model's policy, because policy is probabilistic and the EVM is not.

The failure mode of autonomous agents is not that they are wrong. It is that they are confidently wrong about well-formed inputs. A human trader looking at a frozen chart notices that the chart is frozen. An agent reading answer = 0 sees 0 and treats it as a price.

What the Completeness Matrix Missed

In 2024 I audited a custody solution's multi-signature implementation for an institution preparing ETF-related infrastructure. The key management protocol had no verifiable recovery path for lost shares — a gap that violated the compliance standard the client was being measured against, not any cryptographic property. I proposed a Shamir-based recovery framework with a published, auditable reconstruction ceremony.

The review artefact that nearly buried the finding was the completeness matrix: a spreadsheet in which every control was marked compliant, partially compliant, or not applicable. The recovery control had been marked not applicable at intake, because the original threat model scoped to key theft and not key loss. Every subsequent reviewer saw a fully populated row and moved on. The matrix was well-formed. The schema was satisfied. The payload was empty.

I have since insisted that no audit deliverable be considered complete until every not-applicable field carries a written justification with a named scoping owner. It slows intake by roughly a day. It has caught three findings since.

The Incentive to Report Nothing

The contrarian read is that this is an engineering problem awaiting better tooling. It is not. It is an incentive problem wearing an engineering costume.

Nobody is paid to report absence. Oracle operators are compensated for publishing values, and a round that publishes nothing produces no revenue and no reputation. Monitoring vendors alert on deviation — a twenty percent move in a fifteen-minute window — because deviation is a signal that sells dashboards. A feed that quietly returns zero produces no deviation. It produces an alert only if someone was paid to write a null-check, and null-checks are classified as trivia until the day they are classified as post-mortems.

The regulatory layer is worse. If an uninitialised price feed triggers a cascade of liquidations, the exchange did not write the code, the oracle node did not write the code, and the auditor marked the control not applicable. Code is law, until it isn't — and in a courtroom it is the written scoping decision, not the on-chain invariant, that determines who pays.

Cosmos's IBC is instructive here by contrast. Its packet lifecycle has an explicit timeout and an explicit acknowledgement, and a packet that is neither acknowledged nor timed out is a state the protocol can name. That naming is why IBC chains fail loudly at the boundary rather than silently in the middle. Most generic message-passing designs have no word for the third state.

The Next Exploit Is a Null

My forecast, stated with the confidence that eleven years of post-mortems buys: the next nine-figure loss in this cycle will not be a reentrancy, an oracle manipulation, or a bridge signature forgery. It will be a schema-valid, semantically empty message that every validator along the path approved, and it will be discovered in a log line reading zero.

One unchecked loop, one drained vault — and increasingly, one unchecked null.

The test I now apply to any integration is not whether it handles bad data. It is whether the system can express the absence of data at all. If it cannot name emptiness, it will spend it.