On the morning of the raise, the security dashboard was green. Not green because a human had validated it. Green because the pipeline that was supposed to emit findings returned an empty array, and the gate that read that array had been written to treat length == 0 as a pass. The report generated. The PDF carried a logo. The badge went onto the landing page.
Nobody opened the JSON.
I have spent enough of my career inside audit tooling to know this is not an exotic failure mode. It is the default one. When a system's success condition is "nothing found," a broken system and a clean system produce byte-identical output. Both return silence. The difference between a scanner that ran and found nothing and a scanner that never ran at all is invisible at the layer where most teams look โ the layer where the summary is rendered and the checkbox is ticked.
The code does not lie, but the auditor must dig. And lately the auditor has been digging through a repository whose only artifact is an empty template.
The context here is not a single protocol. It is the artifact chain that modern crypto security depends on: a worker scans, an aggregator normalizes, a signer attests, a dashboard renders. Four layers, each capable of failing silently, and only the last of which is visible to the buyer.
Provenance is the entire point of that chain, and provenance is precisely what an empty result destroys. A signed attestation says this document was produced by key X. It does not say the process behind this document executed. Those are different claims, and the market has spent this cycle pricing them as if they were the same claim.
I met the shape of this problem in 2017, during six weeks inside the Parity Wallet v1 source. The critical issue sat in the kill function โ a visibility and initialization flaw that let an arbitrary address drain a multisig. No scanner flagged it. I found it by reading the inheritance graph and asking what happens when a library contract is initialized but never claimed by its wallet. The tooling of that era was not wrong. It was silent, and silence read as safety. I filed the disclosure, took the bounty, and internalized a rule I have not broken since: a null result is a hypothesis, not a verdict.
Look at the two payloads a scanner can return to its aggregator. They are not the same object, and at a glance they are indistinguishable.