I pulled a payload out of an ingestion pipeline last week and stared at it for a while. Every field was present. Title. Source. Type. Domain. Core claim. Information points. Stance. Purpose. Protocols referenced. Time sensitivity. Source quality. Eleven keys, one object, zero values.
HTTP 200. Schema valid. And three downstream systems — a dashboard, an alerting rule, and a risk model — consumed it as fact.
That is not a parsing bug. That is a pipeline reporting success while carrying nothing, feeding a consumer layer that has no vocabulary for the phrase "I don't know." The stage-one deconstruction did exactly what it was built to do: it emitted a well-formed struct. It just happened to emit an empty one. Nobody upstream flinched, because nothing upstream was looking.
This is the most common failure mode in on-chain data infrastructure right now, and it is almost never the thing anyone audits.
Here is the mechanical picture. A modern ingestion pipeline is a chain of stages with a typed contract between each pair. Stage one extracts; stage two analyzes; stage three renders. The contract is usually a struct with optional fields, because the extractor cannot guarantee it will find a title, a source, or a set of information points in every document it touches. So the schema marks those fields nullable. JSON Schema says required — meaning the key must exist — not meaningful. TypeScript writes string | null. Python writes Optional[str] = None.
Then the runtime hands over the null, and the consumer does what consumers do: it coerces. null becomes 0. "" becomes a string. An empty array becomes "no findings." The type system said this may be absent. The consumer heard this is zero.
On-chain systems have the same shape and worse consequences. An event decoder hits an unknown function selector and, instead of reverting, returns a default tuple. A subgraph entity is created with default field values because the handler fired before the related entity existed, so derivedETH sits at 0 and the TVL chart draws a cliff that never happened. An oracle round is stale, so the aggregator serves the last known price with a fresh timestamp glued on top. Every one of those produces a schema-valid, semantically empty record. Every one of them looks like data.
Numbers are the dangerous case. A null in a string field at least looks wrong — a blank title in a dashboard reads as a blank title. A null in a uint256 field becomes 0, and 0 is a legal, load-bearing, entirely plausible value. A zero collateral balance and an unknown collateral balance are the same seven characters on the wire. One of them liquidates a position. The other one should have halted the bot.
I have spent a lot of time in gas optimization, and the comparison here is exact. Adding a require(x != address(0)) guard costs somewhere in the range of thirty to forty gas. Skipping it costs a bad debt position. The gas isn't the issue — it's the friction of poor architecture. Every engineer who has shipped a decoder knows the trade-off is real: reverting on malformed input halts the indexer, and a halted indexer is a page at 3am. Defaulting lets you keep syncing. But the default leaks downstream, and the leak compounds silently for weeks until someone notices the chart is flat.
The metrics are complicit. Indexers report block coverage — 99.7% of blocks processed, 99.9% of logs decoded. Nobody reports the completeness rate of the resulting entities. Nobody graphs the percentage of records where the core claim field came back empty. If you can't measure the failure, you can't fix it, and coverage is not completeness. A pipeline that processes every block and understands none of them scores a perfect uptime number.
This got considerably worse when agents entered the read path. In 2026 I integrated an LLM-based agent framework against a privacy-preserving rollup, and the vulnerability I found wasn't in the price feed — it was in the gap between the price feed and the model. An agent reading an oracle payload has no native concept of an absent field. Ask it to evaluate a position and hand it a struct where the collateral field is null, and it will not report uncertainty. It will infer. Plausibly, confidently, and in the wrong direction. Code that doesn't fail loudly is code that fails expensively, and a language model wrapped around that code fails expensively and fluently.
Here is the part that cuts against the obvious reading. The empty struct is not the villain. It is the most honest object in the entire system. It says: no title, no source, no claim, no evidence, no position. That is a true statement about a document nobody could parse. The lie happens one layer up, where a consumer that cannot represent ignorance converts silence into a default and ships it to a chart.
Which is why audits miss it. Audit checklists are built around active faults — reentrancy, overflow, access control, unchecked external calls. Nobody writes a checklist item for the absence of information, because absence doesn't throw. Vulnerabilities aren't always bugs. Sometimes they're the shape of a schema that permits silence, and the schema passes review every time because it compiles.
The incentives explain the rest. A pipeline that returns nulls is measured on uptime and ships. A pipeline that halts on nulls is measured on incidents and gets rewritten by the next team. The industry has optimized for liveness over correctness, and it has been doing so for long enough that nobody remembers choosing it.
The fix is not exotic. Make the empty case a distinct type, not a zero. Reject the struct at the boundary where it still has a source attached. Spend the forty gas. Optimization isn't about shaving bytes; it's about respecting the user on the other side of the transaction, and the user on the other side of a null collateral field is a liquidation engine.
So here is the forecast I'd put money on. The next nine-figure loss in DeFi will not be a reentrancy. It will not be a flash loan or a key compromise. It will be an autonomous agent, at 3am, acting with total confidence on a well-formed record whose every field was empty — and the post-mortem will show, in the very first log line, a status code of 200.
How many of your production structs can say "I don't know" without lying?