Empty Is Affirmative: The Silent 'True' Beneath Crypto's Data Stack
Hook
An empty return value is not a null. In the EVM, it is an affirmative.
That sentence cost three token sale teams a delay in 2017. I was in Berlin then, auditing roughly 40,000 lines of Solidity across three early ICO projects, and one of the twelve logical flaws I logged was almost boring. A refund path dispatched a call to an address that had never been deployed. The call succeeded. The boolean came back true. The contract wrote a refund that moved nothing, to nobody.
Beneath the marketing vocabulary of "trustless," the machine's default failure mode is not an error. It is a vacuous success. The EVM does not distinguish between "the answer is yes" and "there was no one there to answer." That distinction is the difference between a protocol and a rumor.
The reason this matters now, in a market that has been chopping sideways for months and rewarding nobody's conviction, is not that the bug is new. It is that the same shape has replicated upward, layer by layer, until the failure mode sits inside oracles, indexers, data availability provisioning, and the AI research pipelines that institutions are beginning to consume as inputs. Truth is not found; it is compiled. And a compiler that treats absence as a pass will compile a very confident false statement.
Context
To understand why the bug keeps reappearing, you have to look at what CALL actually is.
The EVM's message-call instruction is not method dispatch. It is a message send to a 20-byte address, and every 20-byte address in the state trie is legal. Most of them have no code. When the EVM delivers a message to an account with empty code, it executes zero opcodes and returns. Zero opcodes cannot revert. Therefore the call returns 1.
Solidity's high-level wrapper address.call(bytes) returns (bool success, bytes memory data). The success flag means exactly one thing: the call frame did not revert. It does not mean the target existed. It does not mean the function existed. It does not mean the return data matched the ABI you expected. It means a green check mark on a blank page.
The failure mode is older than Solidity. The DAO's reentrancy bug in 2016 was a sequencing failure — state updated after an external call rather than before. The Parity multisig freeze in 2017 was an ownership failure — a library contract self-destructed and took the wallet logic with it. Both were catastrophic and both were loud. The extcodesize omission is the opposite: it is quiet, it is cheap to make, and it has never once appeared on a post-mortem timeline because the transaction did not fail. Auditors who hunt reversions walk straight past it.
The industry noticed the shape early and tried to patch it at the application layer. ERC-20's transfer was specified to return bool — a ritual acknowledgement that the recipient had accepted the funds. Then reality split the standard into three grammars. Tether's token returns nothing at all. A second family returns false instead of reverting. A third reverts with custom errors. Three ways of saying no, one interface, and no way for a caller to know which one it is holding.
The consequence lives inside the tooling everyone now treats as gospel. OpenZeppelin's SafeERC20 — the library that largely defines "correct" ERC-20 handling — does this:
