Hook
An empty data feed and a healthy data feed look identical the moment they reach production. Both return a value. One of them returns zero.
That single line explains more crypto liquidations than leverage does. When an oracle goes stale, an indexer returns an empty array, or an RPC node hands back a null where a price should sit, the downstream system does not crash politely. It computes. It divides. It liquidates. It opens positions on a market that does not exist.
I have spent four years building and auditing automated systems for a copy-trading desk. The first thing we instrument is never the strategy. It is the nullability of every input feeding the strategy.
A bot does not fail because it is wrong about the market. It fails because it was never told the market was missing.
Context
The mechanics are boring, which is exactly why they get skipped.
An Ethereum client answers an eth_call for latestRoundData() and returns a tuple: roundId, answer, startedAt, updatedAt, answeredInRound. If the feed has stopped updating, the answer is not empty. It is the last known answer, timestamped. updatedAt is the field that tells you the truth. Most integrations read answer and ignore updatedAt.
Do the same exercise with a subgraph. Ask for the last 24 hours of swap events on a pool that had no swaps. You get an empty array. Not an error. Not a null. An empty array, which in a loosely typed script coerces cleanly, iterates zero times, and produces a volume of zero. Your dashboard now reports a pool with no activity. It looks calm.
Chainlink's own documentation warns integrators to validate staleness against a heartbeat, and every year a Compound v2 fork forgets. The pattern is consistent: a price feed with a 24-hour heartbeat misses a heartbeat during a weekend of thin liquidity, a fork's oracle wrapper does not check updatedAt, and the collateral asset gets priced at whatever number the feed froze on. Borrow against it at the wrong value and the position either becomes unliquidatable or instantly liquidatable, depending on which direction the freeze broke.
That is not a market event. It is a plumbing event wearing a market event's clothes.
Core
Here is where this stopped being a developer problem and became an alpha problem.
On my desk we run a nightly reconciliation across every wallet we mirror. For each position we pull oracle updatedAt, pool sync() timestamps, and indexer lag. Then we plot the gap between 'the last time the price was real' and 'the last time a human looked at the price.' In a bull market that gap widens. Everyone is watching price. Nobody is watching freshness.
Staleness is a hidden short position that nobody models, and it pays out precisely when volatility is highest โ at 3 a.m., on a Sunday, when the liquidators are asleep and the feeds are frozen.
Three structural failures recur.
First, the type coercion. A function declared to return a uint256 cannot return null, so exhausted feeds return zero. Zero is falsy in most languages, which means a simple truthiness check evaluates false and the code path diverges silently โ sometimes to a fallback, sometimes to a skip, occasionally to a division that produces infinity. Solidity 0.8 reverted on overflow; older contracts did not. Every generation of this bug is the same bug wearing new version numbers.
Second, the empty-array-is-not-an-error assumption. Indexing pipelines treat a missing record as a record with no events. Reorgs make this worse: a block gets orphaned, the indexer rewinds, and for ninety seconds the latest state is genuinely unknown but reports itself as unchanged. Ninety seconds is four blocks. Four blocks is enough to arb.
Third, the human layer. This is the one nobody audits. When a report comes back with half its fields unpopulated, analysts read the populated half. The empty half reads as 'no finding,' not 'no data.' An all-N/A risk report and a clean risk report are formatted identically, and human beings resolve that ambiguity in favor of the answer they already wanted.
I learned that lesson the expensive way. In 2020, when I was running $150,000 of liquidity across Uniswap and SushiSwap and automating arbitrage in Python, I had a naive try/except that swallowed every exception and returned the previous cycle's price. It worked for three months. Then a mainnet RPC returned a partial response during a congestion spike, my script priced a pair off the last cycle, and I arbed against my own stale assumption. I did not lose much. I lost more than that the next year, when I traded hope for logic only after the NFT floor collapsed.
The lesson generalized: your system's most dangerous state is not 'down.' It is 'up with bad inputs.' A down system is loud. A system running on stale data is quiet, confident, and profitable until it is not.
There are two oracle families and they fail in opposite directions.
Push oracles, the Chainlink model, write a price on-chain on a heartbeat or a deviation threshold. The consumer reads whatever is stored. Freshness is the protocol's job, and it is a shared job โ one stale feed is visible to everyone, which means it usually gets caught by someone. Pull oracles, the Pyth model, do not store anything. The consumer fetches a signed price update and submits it with the transaction. Freshness becomes the consumer's job, per call, per block, and the SDK gives you two doors: one that checks the publish time and reverts if the data is too old, and one that does not. getPriceNoOlderThan and getPriceUnsafe. The naming is honest. The integration rate is not.
A pull-oracle integration that calls the unsafe path in a liquidation function is not a bug in the oracle. It is a business decision someone made at 2 a.m. to ship.
The second failure mode I want to name is indexer lag, because it is the one that actually produces money for some people and losses for everyone else.
Between the block a swap lands and the block your dashboard admits it, there is a window. Subgraph indexing on a busy chain regularly runs thirty to ninety seconds behind the head. During that window your screen shows a pool at an old price, a lending market at an old utilization, a vault at an old share price. The chain has already moved. You are trading a photograph of a market that no longer exists.
In a bull market this window is where a specific kind of copy-trading strategy quietly dies. I mirror wallets for a living, and the single largest source of slippage in our book is not bad wallet selection. It is executing against an indexer that was still describing last block's liquidity.
There is a third layer, and it is not technical.
This one I only understood after I started employing people. A pipeline that returns all-N/A does not announce itself as broken. It announces itself as complete. I have watched a report land on a desk with every field reading 'insufficient data' and be filed as 'no issues found,' because the person reading it had twelve other tabs open and the format looked like a green light. The report was not lying. The reader was pattern-matching. Null and safe occupy the same visual slot, and under time pressure humans pick the cheaper interpretation.
That is why I now force a hard distinction in every dashboard I sign off on: an empty field renders red and a validated-clean field renders green, always, with no neutral state. A system that cannot express 'unknown' will express it as 'fine.'
Quantify it. A mirrored position of $40,000 sized off a stale share price that is 2% wrong is an $800 error before fees. Do that across two hundred mirrored wallets twice a month and you have a six-figure annual leak that never shows up in a P&L as a loss, because it looks like execution slippage. Nobody investigates slippage. Slippage is expected. That is precisely why it is the perfect place to hide.
The engineering fix is unglamorous and everyone knows it. Fail closed, not open. Validate updatedAt against a heartbeat appropriate to the pair, not to the protocol. Reject zero as a price, because zero is never a price. Treat an empty event array as an error when you asked for a specific window. Set a hard staleness ceiling at the consumer, not at the provider, because the provider's SLA is not your risk limit.
We don't instrument the null path, because the null path only fires when everything else has already gone wrong.
I have written that paragraph into three different onboarding documents and I have watched three different teams skip it, because in a bull market the cost of skipping is invisible and the cost of implementing is immediate.
And the same discipline applies to research, not just infrastructure. When I read a project risk memo and the tokenomics section is thin, I do not grade it neutral. I grade it uninvested. An unanswerable question is not a coin flip. It is a reason to size down to zero. The market doesn't reward you for generous assumptions about data you never had.
Contrarian
The consensus in 2026 is that data integrity got solved. Substreams, decentralized oracle networks, forty-plus independent node operators, cryptographic attestations. The bull market believes the reliability problem is finished.
I think it moved.
The number of data paths feeding a single MEV-adjacent strategy has exploded. A searcher today touches an RPC provider, a mempool stream, a price aggregator, a state indexer, and often a second RPC as failover. Each hop is an independent null-generation surface. Redundancy was supposed to eliminate single points of failure. Instead it multiplied the number of places where a missing value can masquerade as a present one, and it did it without adding a single line of null-handling logic to the consumer.
Failure modes do not compound. They nest.
Dencun made this worse by design. Cheaper blobs meant more rollups, more rollups meant more bridges, and every bridge is another consumer that has to decide what to do when the proving endpoint returns nothing. We added throughput and called it progress.
There is a second contrarian point, and it is the one that unsettles me. The retail assumption is that when an automated system misprices an asset, that is a bug. For a certain class of participant, it is a feature. Any market where one side validates freshness and the other side assumes it has a structural, repeatable, legally unremarkable edge. You do not need insider information to liquidate a borrower priced off a frozen feed. You need a cron job and patience.
That asymmetry is not going away, because fixing it costs throughput and every protocol is optimizing for throughput in a bull market. When the market is euphoric, freshness checks get deprioritized in the same commit that raises the gas limit.
Takeaway
So what do you actually do with this?
Stop asking whether your data is correct. Ask when it was last true, and what your system does in the ninety seconds before it is true again. Instrument updatedAt, not answer. Treat an empty array as an error, not an absence of activity. Log the null path. The bugs that kill accounts are almost never in the strategy; they are in the branch that runs when the input is missing and the code decides to keep going.
I would rather run a bot that halts loudly at 3 a.m. than one that trades quietly on a number from Friday. Speed wins the trade, discipline keeps the profit. Neither of them survives a zero that nobody checked.