In late November 2022, a price feed on Compound reported that DAI — a token engineered to hold exactly one dollar — was worth a fraction of a cent. No attacker forced the number. No flash loan dragged it there. A newly deployed oracle contract returned a default value where a live price should have stood, and that value propagated through the lending market without a single objection. Positions were liquidated against a price that had never existed anywhere except inside a contract's storage slot. The ledger recorded the empty field as if it were a fact, and the market believed it.
That incident is usually filed under "oracle bug." That is the wrong folder. What failed at Compound was not the oracle's arithmetic. What failed was the pipeline's refusal to distinguish between a number and the absence of one. Zero is a valid uint. Zero is a valid price. Zero is also what Solidity hands you when a value was never set. The machine cannot tell the difference, and neither could the liquidators.
I have spent fourteen years reading the gap between what code promises and what it does. In 2018, after the ICO wreckage settled, I audited the 0x Protocol v2 settlement module line by line and found seven reentrancy vulnerabilities. None were exotic. Every one was a place where the contract accepted a caller-supplied value it never bothered to verify. The Compound feed is the same disease wearing different clothes. Trust is verified, never assumed — and almost nobody verifies the field that is simply blank.
A price feed is not a number. It is a pipeline, and like every pipeline it has stages: a source reports, an aggregator weights, a transport delivers, a contract stores, a consumer reads. Each stage is a place where the signal can die. The industry diagrams the happy path and leaves the failure path unmanaged.
The design question that decides everything is simple: when a stage fails, does it revert or does it return a default? These are called fail-closed and fail-open, and the difference is the difference between a locked door and a door that opens onto a cliff.
Solidity defaults to fail-open in the worst possible way. An uninitialized state variable is zero. A mapping lookup for a missing key is zero. A function that assigns nothing still returns zero. Zero does not throw. Zero does not log. Zero is a perfectly ordinary integer that a downstream contract will happily multiply, divide, and liquidate against. Silence in the logs speaks loudest, and the loudest silence in DeFi is a zero that everyone agreed not to question.
The parallel outside crypto is exact. In any automated content or analytics pipeline, the most dangerous failure is not the crash. A crash is loud; it stops the line. The dangerous failure is the one where the input never arrives, the parser produces nothing, and the pipeline — built to always emit something — emits a confident default. Downstream, a human or a model reads that default as data and generates a conclusion that is fluent, plausible, and entirely fabricated. The technical term is hallucination. The operational term is a lie with good formatting.
When I audit a data-dependent system, I do not start with the code that works. I start by asking what happens at step zero, before any real input exists. There are three failure modes, and every serious incident I have documented falls into one of them.
Input failure — the data never arrived. The oracle node was offline, the indexer never crawled the block, the sequencer never included the transaction, the API timed out. In the analysis world, this is a scrape that failed. On-chain, it is a feed that skipped a round. The pipeline receives nothing and must decide what to do with nothing. Most decide to do nothing — which is to say, they pass the void forward.
Parse failure — the data arrived but was not extracted. The payload came in malformed or in a shape the decoder did not expect, and the decoder dropped it on the floor rather than raising. In practice this is an empty array where prices should be, a null where a struct should be. In 2021, I analyzed the ERC-721 implementations behind several top collections and found that roughly 30% of popular marketplaces never enforced royalties at the protocol level; they relied entirely on off-chain goodwill. That is a parse failure at the economic layer — the data about who should be paid arrived, and the system silently discarded it.
Process defect — the pipeline emitted a default instead of an error. This is the Compound case. A script or contract is written to always produce output, so when it has no real input it produces a template. On-chain, the template is zero. The defect is not a missing check; it is a design philosophy that treats empty as a valid value. The pipeline should have halted. It did not, because halting was never coded in.
Now trace what happens downstream when a default escapes. A consumer reads zero. It has no reason to doubt zero, because zero passed every type check. It sizes a loan against zero, computes a health factor against zero, triggers a liquidation against zero. The output is fluent and the conclusion is fabricated. In analysis terms, the model invents a thesis to fill the empty field. In DeFi terms, the market invents a price and settles real money against it. The mechanism is identical.
The fix, in every system I have reviewed, is the same three-part repair, and it is unglamorous.
First, a gate. The pipeline must hard-stop when its input is empty, rather than passing a default. On-chain this is the sanity check — require(price != 0) — but a bare zero-check is a weak gate, because a real price can legitimately be small. A proper gate is a band: reject values outside a deviation threshold from the last known good print, and reject values older than a staleness window. A gate is the difference between a system that fails closed and one that fails onto a cliff.
Second, validation metadata. The empty pipeline in question had no status field — no way to say "this run produced nothing." On-chain, the equivalent is provenance: a round ID, an updatedAt timestamp, a source identifier. A price without a timestamp is not a price; it is an opinion with no date. Every pixel holds a transaction history, and a number without provenance is a number you cannot audit.
Third, a fallback. When the primary path fails, the system needs a defined secondary — a backup oracle, a time-weighted average, a circuit breaker that pauses the market. The analysis world calls this OCR or human review. DeFi calls it a TWAP or a guardian. The name matters less than the existence. A pipeline with no fallback has exactly one behavior when its input dies: it passes the corpse along.
I built this discipline the hard way. In 2020, during DeFi Summer, I spent three months stress-testing Curve's stablecoin pools against simulated oracle manipulation and documented fourteen distinct liquidity fragmentation scenarios. The finding that mattered was not that incentives were misaligned; it was that liquidity is a mirror, not a moat — a deep pool reflects the inputs you feed it, and if you feed it a bad price, its depth only amplifies the damage. Depth without a gate is leverage against yourself.
In 2022, during the bear market, I went deep into Celestia's data availability sampling and replicated their proof-of-stake verification logic over four months. The entire point of that design is to refuse the assumption that data is present. Data availability sampling exists precisely because "the data is probably there" is not a guarantee — it is a hope. Trust is verified, never assumed. A rollup that assumes its data landed is a rollup that will one day discover it did not, at the worst possible moment.
And in 2024, leading an audit of three major Ethereum L2s, my team found a critical bug in Optimism's dispute resolution logic that could have allowed state root manipulation affecting roughly $2 billion in locked value. That bug was not a broken computation. It was a validation gap — a path by which a state root could be accepted without a proper challenge. The system worked perfectly on every honest input and failed catastrophically on the one input it never gated. We submitted the report; it was patched before funds moved. Stability is engineered, not emergent, and it is engineered precisely at the points where the pipeline would otherwise return nothing.
The same pattern recurs wherever I look. The Lightning Network has spent seven years unable to reliably find a payment path, and every failed route is a silent drop — a payment that neither completes nor cleanly errors, just evaporates into a retry loop. That is a routing pipeline that fails open by design, which is a large part of why it remains a niche. The OP Stack and ZK Stack contest is rarely decided by cryptographic elegance; it is decided by who gets more chains to consume their pipeline first. And stablecoin rails move real volume in inflationary economies not on ideology but because, unlike a collapsing local currency, a well-gated dollar rail fails loudly when it fails at all. Beneath the hype, the logic remains static.
Here is the counter-intuitive part, and it runs against the grain of the industry's dashboard culture. We celebrate uptime. We post green status pages. We treat a system that never goes down as one that works. But availability and integrity are different properties, and a system can have perfect availability while returning garbage every single block. A feed that never misses a round and always reports zero has 100% uptime and zero integrity. By the metrics we publicly admire, it is a flawless oracle.
This is why fail-open is the quiet default of the stack. Solidity returns zero instead of reverting. REST APIs return 200 with empty bodies. Indexers return empty arrays rather than errors. Every layer is optimized to always produce something, because "something" keeps the pipeline running and the dashboards green, and because a halted pipeline is a failure someone must explain. The industry has systematically chosen the failure mode that hides itself. Silence in the logs speaks loudest, and we built our infrastructure to be very, very quiet.
There is a second uncomfortable truth. Immutability does not protect you here. The ledger does not distinguish between a true price and a defaulted zero; it records both with equal fidelity and equal permanence. "Code is law" cuts both ways — it means the bug is law too. The ledger remembers what the code forgot, and what the code forgot, in this case, is to ask whether the field was ever filled.
The next nine-figure exploit will not be a clever reentrancy or a stolen key. Those are loud failures, and loud failures get patched. The next one will be a null that nobody gated — an empty field that a downstream contract, an indexer, or a model consumed as truth and sized a position against. Forensics reveals the intent behind the hash, but there is no intent behind an empty slot, only a decision someone made not to check it. As modular stacks multiply data dependencies between layers, the surface for silent failure grows faster than the surface for loud failure, because every new dependency is another place a default can hide. The question to ask every protocol you touch is not "what does your oracle return?" It is "what does your oracle return when it does not know?" If the answer is anything other than a revert, you are not reading a price. You are reading a promise that the pipeline will always have something to say.