Tuesday. 03:14 UTC. A mid-tier price aggregator on Solana pushed 4,812 payloads downstream. Every checksum passed. Every JSON schema validated. Every value came back null.
Three of the fifteen largest agentic vaults by TVL kept firing anyway. Eleven minutes and twenty-one seconds later they had routed $612M in notional across 4,812 transactions, execution drag running 39 basis points above their own seven-day baseline. Realized slippage: $2.4M.
No liquidations. No circuit breakers. No red banners on any dashboard. The failure didn't throw an error — it threw a P&L line. And by the time a human noticed, the nulls had already been coerced into prices, prices into orders, orders into losses.
I was hunting spreads while the market sleeps when the first Discord ping came through. Nothing about it looked like an incident. That's the entire problem.
Context: The Pipeline Nobody Audits
Agentic vaults are the defining DeFi primitive of this cycle. You deposit, a cluster of agents picks the strategy, a shared revenue contract splits the take between vault, model provider, and orchestrator. TVL across the twenty largest crossed $14B in Q1.
The architecture is boring, and that's the point. Vendor publishes prices. Normalizer coerces them into a canonical schema. Model consumes the schema. Router turns model output into orders. Four hops, three vendors, one SLA.
The depositor base has shifted, too. Two years ago these vaults were retail wrappers with $40M caps and a Discord full of apes. Now the median depositor is a treasury desk at a mid-cap protocol chasing yield on idle stablecoin float, with hard drawdown limits written into the mandate. That changes the failure calculus. A 39 bps execution drag isn't a rounding error to a treasury desk. It's a variance event that forces a disclosure.
Last year I audited the revenue-sharing mechanics of fifteen Solana-based agent frameworks. I found a rounding asymmetry in how transaction fees were split between orchestrator and model provider — a flaw that quietly concentrated 6.2% of daily fee flow. On $4.1M of daily fees, that's $254K a day leaking to whoever wrote the split function. The upgrade that followed reallocated roughly $2M in annualized flow and forced each of those teams to publish fee-attribution documents.
That audit taught me something I keep relearning: agent frameworks self-report profit extremely well and blindness extremely badly. Nobody publishes a null-handling policy. Nobody thinks to.
Core: Three Ways A Feed Lies Without Lying
I pulled the raw payloads from an archival RPC node and replayed the window. Three failure modes stacked.
The heartbeat kept beating. The aggregator's status endpoint reported "healthy" for the full eleven minutes because the publisher's job was still executing. The cron fired. Calls returned 200. The process was alive. Uptime monitors measure liveness, not truth, and the two diverged completely at 03:14.
The schema absorbed the null. This is the part that matters. The canonical price object has a value field typed as a float. Upstream returned nothing; validation passed because the shape was correct; then the coercion layer did what coercion layers do. Some parsers mapped null to 0. Some held last-known. Some propagated an empty string the model's tooling quietly read as "no signal."
Three different defaults inside one four-hop pipeline. Vault A priced assets at zero. Vault B priced them at Monday's close. Vault C refused to price and routed anyway on cached weights. Three vaults trading against each other's hallucinations with no shared reality in between.
That divergence is where the $2.4M went. Not to a hacker. Not to an exploit. To arbitrageurs who spotted the spread in under ninety seconds — because to a fast enough observer, a broken oracle and a gift are indistinguishable.
Replay the tape and the arb itself is almost boring. A bot watching three vaults sees Vault A quoting an asset at zero and Vault C quoting the same asset at Monday's close. It buys from A at zero, sells into C at stale, twenty-one times, before either risk module trips. No exploit contract. No flash loan. No oracle manipulation. Just two systems disagreeing loudly enough for a third to hear.
I've seen this shape before. Chasing the white whale in the 2017 ether rush, the failure was always the same flavor: infrastructure fine, assumptions broken. In 2017 it was exchanges reporting volume from wash-trading bots. In 2026 it's an SLA guaranteeing 99.95% uptime that says nothing about accuracy.
Nobody owned the last mile. The vendor's contract covered publication. The normalizer's covered parsing. The vault's covered strategy. Between "valid JSON arrives" and "a number the model can trust exists" sits a gap roughly the width of a legal department, and every party can point at the party before them and be technically correct.
None of the three vaults has published a post-mortem. Two confirmed the outage privately to depositors. The third responded to my query by pointing at its vendor's status page — which, as established, reported healthy throughout. The vendor has not commented. That silence is itself a data point: in agentic DeFi, losses get disclosed when they're attributable and buried when they're architectural.
Speed kills slower than greed. Here it killed in eleven minutes.
The Math Traders Actually Care About
Strip the narrative.
Baseline execution drag across the three vaults, prior seven days: 9 bps. During the window: 48 bps. Excess: 39 bps on $612M notional = $2.39M of pure friction. No liquidations, because the vaults sized off stale collateral values that happened to be conservative. Pure luck. Had the nulls coerced upward, the same eleven minutes produces forced deleveraging across three vaults holding $1.8B combined TVL, with a cascading liquidation path into two lending markets.
That's the asymmetry nobody prices. A data outage has a bimodal loss distribution: annoyance or catastrophe, and the coin is flipped by a default value in a config file.
Regulatory exposure is real now, too. Under DORA, a price vendor feeding automated execution qualifies as a critical ICT third-party provider, and operational-resilience expectations attach to fidelity, not availability. A vault sector running on vendors whose contracts promise uptime is the structural gap that generates enforcement eighteen months after a loss, not eighteen days.
Concrete test. Ask any vault you're deposited in what its normalizer does with a null. If the answer arrives within the hour and cites a line of code, you're fine. If the answer is "our vendor handles that," you're not.
Volatility is just noise until it becomes signal. Nulls run the same trick in reverse.
Contrarian: Blame The Vendor, Not The Model
The reflexive take is "AI agents are reckless." Wrong target. The agents did exactly what they were specified to do. They consumed a canonical schema and produced orders. The schema lied.
The blind spot sits with vendors and the buyers who let them pick the metric. Vendors sell coverage — pairs, venues, latency percentiles — because coverage is countable and fidelity is not. No vendor has ever lost a deal for publishing fast wrong numbers. Plenty have lost deals for publishing slow right ones.
Second blind spot: agents in a chop market have no directional edge, so they monetize flow instead of accuracy. When there's no trend to capture, revenue comes from turnover. That incentive makes an eleven-minute outage profitable for the orchestrator and expensive for the depositor, and fee-split contracts are structurally silent on the difference.
There's a third, and it's the one that ends up in court. Vault depositors have no contractual relationship with the price vendor. The vault has no SLA with the normalizer. The normalizer has no SLA with the publisher. Liability terminates at a null pointer, and the entity holding the loss sits four hops downstream of the entity that caused it.
Minting ghosts at light speed is a business model now.
Takeaway
Watch three things over the next two quarters: whether a major aggregator ships a signed staleness attestation alongside its price payload; whether agentic vaults disclose null-handling policy the way they now disclose fee splits; and whether DORA-driven vendor audits start demanding fidelity SLAs with financial teeth.
Until then, treat every agentic vault's historical Sharpe as an artifact of a data layer that has never been stress-tested in daylight.
The next eleven-minute window won't announce itself either.
