The most dangerous value in an oracle feed is not zero. It is nothing.
Two weeks ago I sat through a post-incident review of a mid-cap lending market where a monitoring dashboard had rendered four consecutive hours of a utilization input as an em dash. No alert fired. No page went out. The borrow rate kept publishing anyway, because the interest rate model did not require the input to be true — only to be numeric. The contract read a stale integer, pushed it through a kinked curve, and emitted an interest rate that no market anywhere had agreed to.
Trust is not a virtue; it is an unpatched port. The industry has spent four years hardening that port against lies. Almost nobody has hardened it against silence.
The Data Plane Is the Market Now
The market is sideways. Chop is for positioning, and the useful signals in a chop are not on the chart — they are in the data plane. Everyone is staring at funding rates and liquidation heatmaps, waiting for direction. The better question is what happens to those systems when a feed goes quiet.
Oracle architecture has been stable for years. Publishers post signed observations off-chain. An aggregator takes a median or a reputation-weighted mean. A relayer writes the answer and a timestamp into a storage slot. Consumers call latestRoundData() and check three things: is the answer positive, is the update fresh enough relative to a heartbeat, and did it deviate beyond a threshold that would trip a circuit breaker.
That is the entire safety model. Three checks, all of them designed around the assumption that the feed will eventually say something.
Layer-2 added a fourth check after the sequencer failures of 2023: an uptime feed. When the sequencer halts, the uptime feed flips and lending markets are supposed to freeze liquidations, because on a dead sequencer every price is stale by construction and every position looks liquidatable at once. The industry treated this as a solved problem. It was a genuine engineering improvement. It was also the moment we replaced a data problem with a governance problem, and nobody updated the threat model.
Every summer has a winter of truth, and the winter always arrives as a missing field.
Absence Has No Type
Now the teardown. The EVM has no null. Every value is a uint256, and every uint256 is a number. So "absence" must be encoded, and the encoding is a convention rather than a guarantee. Some feeds mark absence with updatedAt == 0. Some mark it with answer <= 0. Some mark it by not updating at all and letting the previous round persist in storage.
A missing value that passes `answer > 0` is not a stale price. It is a fabricated one.
Two years ago I modeled this for a different reason. I wanted to know how much staleness a liquidation engine could absorb before it stalled. I ran roughly 200 hours of simulation across historical volatility regimes, assuming a 30-minute heartbeat and a 0.5% deviation threshold. The model had a floor: below about 11 minutes of skew, the engine behaved. Above 40 minutes, liquidations did not fail loudly — they failed quietly. Health factors drifted upward in the accounting while debt positions were economically underwater. Bad debt did not appear as an event. It appeared as a slow reclassification.
That is the failure mode nobody writes incident reports about. There is no transaction to point at. There is no attacker to name.
The mechanism is usually caching. Contracts store the last good answer and reuse it when the oracle call reverts or returns an empty round. This is a defensible gas optimization and a complete surrender of the staleness guarantee. The heartbeat check that was supposed to bound your exposure is now bounded by nothing, because the cached path never touches it.
The deviation threshold is the second trap. Circuit breakers trigger on deviation between the new answer and the previous one. If no new answer arrives, there is no deviation. A feed that has stopped is the only feed that can never trip a circuit breaker. The safety mechanism is keyed to a signal that only exists while the system is working.
I would rather not name the protocol I reviewed, because the pattern is not specific to it. I found it in a collateral adapter where updatedAt == 0 was checked, answer > 0 was checked, and the round ID was never verified to be monotonically increasing. A replayed old round passes every check. The data has a timestamp. The timestamp is real. It is simply not recent, and nothing in the call path compares recency to a bound that matters.
The Rate Curve Is a Rumor With a Formula
This is where DeFi's own math betrays it. Aave and Compound's interest rate models are not discovered from markets. They are parameterized: a base rate, a slope below the kink, a steeper slope above it, a jump multiplier. Reasonable engineers disagree about the constants, which tells you the constants are arbitrary. Feed a kinked curve a utilization ratio derived from a reserve balance that has not been reconciled since the last oracle round, and you get a borrow rate produced by arithmetic rather than by supply and demand.
A rate curve fed stale utilization is not a market price. It is a rumor with a formula.
The obvious objection is that rates are smoothed, and smoothing tolerates noise. True, and irrelevant. Smoothing is a low-pass filter. It attenuates high-frequency error and passes low-frequency error unchanged. A four-hour stale input is the lowest-frequency error there is. You have built a filter that is perfectly transparent to the exact signal you are afraid of.
The same logic runs through the newest institutional narrative. Real-world asset feeds post a net asset value, often weekly, signed by a fund administrator that is a single legal entity. The heartbeat on that feed is a formality. A 7-day-old NAV on a 24/7 collateral market is not a price. It is an accounting opinion, and the market prices against it anyway.
Two Nodes Agreeing About Each Other
Now the sequencer.
In 2025 I spent six months reverse-engineering the off-chain computation path of a major oracle network, specifically the node selection algorithm, because I wanted to know how many independent parties actually had to collude to move a feed. The answer was lower than the documentation implied. Not one node. Not a clean supermajority in any adversarial-threshold sense. A small, rotating, reputation-weighted set whose membership is itself determined by a governance process that a handful of delegates control.
The uptime feed has the same shape. It is a centralized attestation about a centralized operator.
The sequencer uptime oracle is one node's opinion about another node's health, relayed to a contract that treats the opinion as ground truth.
I have audited bridges with this exact structure. In 2021 I spent three months inside Wormhole's signature verification path, and the flaw I flagged was not cryptographic. It was type-safety in the message-passing layer: a class of inputs that could parse into a valid-looking verification context with an empty participant set. The bridge was never built, only imagined — and the imagination had a gap where the null should have been rejected.
The general lesson generalizes badly, which is why nobody learns it. The bug is never in the median calculation. The bug is in the branch that handles the case the developer assumed could not happen, written last, funded least, tested never.
The Agent Does Not Revert
Here is where this stops being a historical pattern and becomes a live one.
Autonomous agents now consume these feeds. I wrote earlier this year about latency and trust assumptions in decentralized data pipelines, under the working assumption that the consumer would be a contract. That assumption is already outdated. An agentic system sits between the feed and the action, and its failure mode is the inverse of a smart contract's.
A contract reverts on a null. An agent does not. An agent interpolates. Given a four-hour gap, a sufficiently capable model will reconstruct a plausible price from surrounding context — correlated assets, historical variance, the last observed level — and act on it with the same confidence it would apply to a verified observation.
A deterministic machine fails closed. A probabilistic machine fails gracefully, which is worse, because graceful failure looks like success.
Model this and the numbers get uncomfortable. If a feed is silent for 15 minutes during a 3% hourly move, a contract either reverts — safe, visible, expensive — or uses a stale price, with bounded and measurable error. An agent fills the gap and sizes a position on a number it invented. That error is not bounded by the heartbeat. It is bounded by the model's confidence, and confidence has no heartbeat parameter.
What the Bulls Got Right
A teardown that only subtracts is itself unsound, so here is the concession.
The bulls are right that missing data rarely destroys a protocol outright. Conservative parameters, timelocks, multisig pauses, and governance latency all act as shock absorbers. The uptime feed was a real improvement and it prevented a specific class of cascade. The people who shipped it deserve the credit, and they shipped it faster than the criticism arrived.
The bulls are also right about something subtler: false data is worse than absent data. A lie propagates through every consumer. An absence can at least be detected in principle. The industry's instinct — revert rather than guess — is the correct instinct, and it is more widely held than my tone suggests.
What the bulls miss is the accounting. Damage from nulls does not show up as loss. It shows up as mispricing, and mispricing is absorbed by whoever is least able to measure it. The arbitrageur who read the data plane correctly takes a spread from the LP who read the chart. That transfer never appears in a postmortem, because nothing reverted. Silence in the blockchain is louder than the hack — it is just distributed across a thousand small, legal, unremarkable claims.
The deepest concession is that this is not primarily a code problem. N/A becoming a green light is a human convention. The dashboard rendered an em dash because rendering nothing looked like a system error. The operator read the em dash as no news. No compiler enforces the difference between unknown and fine. Complexity is just laziness wearing a mask, and the mask here is a dash.
Write the Revert
So write the revert. Not for the attack you can name — for the input you never modeled. Assert three states, not two: present, absent, malformed. Make absence a hard failure. Make the failure loud. Make the loudness part of the specification rather than an afterthought bolted into a monitoring script that nobody reads at 03:00.
Then sit with the question the next twelve months will answer. When the feed is empty, the sequencer is dark, and the only thing awake is an agent with a plausible guess — who does it ask for permission?