diff --git a/src/Attr.cc b/src/Attr.cc
index c8633858bf..c57f288313 100644
--- a/src/Attr.cc
+++ b/src/Attr.cc
@@ -192,12 +192,12 @@ void Attributes::AddAttr(IntrusivePtr<Attr> attr)
 	// For ADD_FUNC or DEL_FUNC, add in an implicit REDEF, since
 	// those attributes only have meaning for a redefinable value.
 	if ( (attr->Tag() == ATTR_ADD_FUNC || attr->Tag() == ATTR_DEL_FUNC) &&
-	     ! FindAttr(ATTR_REDEF) )
+	     ! Find(ATTR_REDEF) )
 		attrs.emplace_back(make_intrusive<Attr>(ATTR_REDEF));
 
 	// For DEFAULT, add an implicit OPTIONAL if it's not a global.
 	if ( ! global_var && attr->Tag() == ATTR_DEFAULT &&
-	     ! FindAttr(ATTR_OPTIONAL) )
+	     ! Find(ATTR_OPTIONAL) )
 		attrs.emplace_back(make_intrusive<Attr>(ATTR_OPTIONAL));
 	}
 
@@ -224,6 +224,15 @@ Attr* Attributes::FindAttr(attr_tag t) const
 	return nullptr;
 	}
 
+const IntrusivePtr<Attr>& Attributes::Find(attr_tag t) const
+	{
+	for ( const auto& a : attrs )
+		if ( a->Tag() == t )
+			return a;
+
+	return Attr::nil;
+	}
+
 void Attributes::RemoveAttr(attr_tag t)
 	{
 	for ( auto it = attrs.begin(); it != attrs.end(); )
@@ -632,7 +641,7 @@ bool Attributes::operator==(const Attributes& other) const
 
 	for ( const auto& a : attrs )
 		{
-		Attr* o = other.FindAttr(a->Tag());
+		const auto& o = other.Find(a->Tag());
 
 		if ( ! o )
 			return false;
@@ -643,7 +652,7 @@ bool Attributes::operator==(const Attributes& other) const
 
 	for ( const auto& o : other.attrs )
 		{
-		Attr* a = FindAttr(o->Tag());
+		const auto& a = Find(o->Tag());
 
 		if ( ! a )
 			return false;
diff --git a/src/Attr.h b/src/Attr.h
index 44d28f9d97..fbf60f68a4 100644
--- a/src/Attr.h
+++ b/src/Attr.h
@@ -38,6 +38,8 @@ typedef enum {
 
 class Attr final : public BroObj {
 public:
+	static inline const IntrusivePtr<Attr> nil;
+
 	Attr(attr_tag t, IntrusivePtr<Expr> e);
 	explicit Attr(attr_tag t);
 	~Attr() override;
@@ -93,8 +95,11 @@ public:
 	[[deprecated("Remove in v4.1. Pass IntrusivePtr instead.")]]
 	void AddAttrs(Attributes* a);	// Unref's 'a' when done
 
+	[[deprecated("Remove in v4.1. Use Find().")]]
 	Attr* FindAttr(attr_tag t) const;
 
+	const IntrusivePtr<Attr>& Find(attr_tag t) const;
+
 	void RemoveAttr(attr_tag t);
 
 	void Describe(ODesc* d) const override;
diff --git a/src/CompHash.cc b/src/CompHash.cc
index 1804f24900..7bdc3eba6a 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -183,7 +183,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 				auto rv_i = rv->GetField(i).get();
 
 				Attributes* a = rt->FieldDecl(i)->attrs.get();
-				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
+				bool optional = (a && a->Find(ATTR_OPTIONAL));
 
 				if ( ! (rv_i || optional) )
 					return nullptr;
@@ -514,7 +514,7 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 			for ( int i = 0; i < num_fields; ++i )
 				{
 				Attributes* a = rt->FieldDecl(i)->attrs.get();
-				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
+				bool optional = (a && a->Find(ATTR_OPTIONAL));
 
 				sz = SingleTypeKeySize(rt->GetFieldType(i).get(),
 						       rv ? rv->GetField(i).get() : nullptr,
@@ -906,7 +906,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 				IntrusivePtr<Val> v;
 
 				Attributes* a = rt->FieldDecl(i)->attrs.get();
-				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
+				bool optional = (a && a->Find(ATTR_OPTIONAL));
 
 				kp = RecoverOneVal(k, kp, k_end,
 				                   rt->GetFieldType(i).get(), &v, optional);
diff --git a/src/Expr.cc b/src/Expr.cc
index 672d5b4697..f1a07fefdf 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -5025,7 +5025,7 @@ bool check_and_promote_args(ListExpr* const args, RecordType* types)
 		for ( int i = ntypes - 1; i >= el.length(); --i )
 			{
 			TypeDecl* td = types->FieldDecl(i);
-			Attr* def_attr = td->attrs ? td->attrs->FindAttr(ATTR_DEFAULT) : nullptr;
+			const auto& def_attr = td->attrs ? td->attrs->Find(ATTR_DEFAULT).get() : nullptr;
 
 			if ( ! def_attr )
 				{
diff --git a/src/File.cc b/src/File.cc
index d70d92047a..a496df5034 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -265,7 +265,7 @@ void BroFile::SetAttrs(Attributes* arg_attrs)
 	attrs = arg_attrs;
 	Ref(attrs);
 
-	if ( attrs->FindAttr(ATTR_RAW_OUTPUT) )
+	if ( attrs->Find(ATTR_RAW_OUTPUT) )
 		EnableRawOutput();
 	}
 
diff --git a/src/ID.cc b/src/ID.cc
index 3cb2753ebe..5d1f2f3bc9 100644
--- a/src/ID.cc
+++ b/src/ID.cc
@@ -207,8 +207,7 @@ void ID::SetVal(IntrusivePtr<Val> v, init_class c)
 
 void ID::SetVal(IntrusivePtr<Expr> ev, init_class c)
 	{
-	Attr* a = attrs->FindAttr(c == INIT_EXTRA ?
-					ATTR_ADD_FUNC : ATTR_DEL_FUNC);
+	const auto& a = attrs->Find(c == INIT_EXTRA ? ATTR_ADD_FUNC : ATTR_DEL_FUNC);
 
 	if ( ! a )
 		Internal("no add/delete function in ID::SetVal");
@@ -240,7 +239,7 @@ void ID::UpdateValAttrs()
 
 	if ( GetType()->Tag() == TYPE_FUNC )
 		{
-		Attr* attr = attrs->FindAttr(ATTR_ERROR_HANDLER);
+		const auto& attr = attrs->Find(ATTR_ERROR_HANDLER);
 
 		if ( attr )
 			event_registry->SetErrorHandler(Name());
@@ -248,7 +247,8 @@ void ID::UpdateValAttrs()
 
 	if ( GetType()->Tag() == TYPE_RECORD )
 		{
-		Attr* attr = attrs->FindAttr(ATTR_LOG);
+		const auto& attr = attrs->Find(ATTR_LOG);
+
 		if ( attr )
 			{
 			// Apply &log to all record fields.
@@ -268,7 +268,7 @@ void ID::UpdateValAttrs()
 
 Attr* ID::FindAttr(attr_tag t) const
 	{
-	return attrs ? attrs->FindAttr(t) : nullptr;
+	return attrs ? attrs->Find(t).get() : nullptr;
 	}
 
 bool ID::IsDeprecated() const
diff --git a/src/Type.cc b/src/Type.cc
index 86e901e0fe..cdb55b2131 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -422,7 +422,7 @@ FuncType::FuncType(IntrusivePtr<RecordType> arg_args,
 		{
 		const TypeDecl* td = args->FieldDecl(i);
 
-		if ( td->attrs && td->attrs->FindAttr(ATTR_DEFAULT) )
+		if ( td->attrs && td->attrs->Find(ATTR_DEFAULT) )
 			has_default_arg = true;
 
 		else if ( has_default_arg )
@@ -696,8 +696,7 @@ IntrusivePtr<Val> RecordType::FieldDefault(int field) const
 	if ( ! td->attrs )
 		return nullptr;
 
-	const Attr* def_attr = td->attrs->FindAttr(ATTR_DEFAULT);
-
+	const auto& def_attr = td->attrs->Find(ATTR_DEFAULT);
 	return def_attr ? def_attr->GetExpr()->Eval(nullptr) : nullptr;
 	}
 
diff --git a/src/Type.h b/src/Type.h
index b0b114401a..7dce10f595 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -567,7 +567,7 @@ public:
 	~TypeDecl();
 
 	const Attr* FindAttr(attr_tag a) const
-		{ return attrs ? attrs->FindAttr(a) : nullptr; }
+		{ return attrs ? attrs->Find(a).get() : nullptr; }
 
 	void DescribeReST(ODesc* d, bool roles_only = false) const;
 
diff --git a/src/Val.cc b/src/Val.cc
index f541cfd61a..c1c810556e 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -1476,12 +1476,12 @@ void TableVal::SetAttrs(IntrusivePtr<Attributes> a)
 	CheckExpireAttr(ATTR_EXPIRE_WRITE);
 	CheckExpireAttr(ATTR_EXPIRE_CREATE);
 
-	Attr* ef = attrs->FindAttr(ATTR_EXPIRE_FUNC);
+	const auto& ef = attrs->Find(ATTR_EXPIRE_FUNC);
 
 	if ( ef )
 		expire_func = ef->GetExpr();
 
-	auto cf = attrs->FindAttr(ATTR_ON_CHANGE);
+	const auto& cf = attrs->Find(ATTR_ON_CHANGE);
 
 	if ( cf )
 		change_func = cf->GetExpr();
@@ -1489,7 +1489,7 @@ void TableVal::SetAttrs(IntrusivePtr<Attributes> a)
 
 void TableVal::CheckExpireAttr(attr_tag at)
 	{
-	Attr* a = attrs->FindAttr(at);
+	const auto& a = attrs->Find(at);
 
 	if ( a )
 		{
@@ -1560,7 +1560,7 @@ bool TableVal::Assign(IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
 		}
 
 	// Keep old expiration time if necessary.
-	if ( old_entry_val && attrs && attrs->FindAttr(ATTR_EXPIRE_CREATE) )
+	if ( old_entry_val && attrs && attrs->Find(ATTR_EXPIRE_CREATE) )
 		new_entry_val->SetExpireAccess(old_entry_val->ExpireAccessTime());
 
 	Modified();
@@ -1901,7 +1901,7 @@ const IntrusivePtr<Val>& TableVal::Find(const IntrusivePtr<Val>& index)
 		TableEntryVal* v = (TableEntryVal*) subnets->Lookup(index.get());
 		if ( v )
 			{
-			if ( attrs && attrs->FindAttr(ATTR_EXPIRE_READ) )
+			if ( attrs && attrs->Find(ATTR_EXPIRE_READ) )
 				v->SetExpireAccess(network_time);
 
 			if ( v->GetVal() )
@@ -1925,7 +1925,7 @@ const IntrusivePtr<Val>& TableVal::Find(const IntrusivePtr<Val>& index)
 
 			if ( v )
 				{
-				if ( attrs && attrs->FindAttr(ATTR_EXPIRE_READ) )
+				if ( attrs && attrs->Find(ATTR_EXPIRE_READ) )
 					v->SetExpireAccess(network_time);
 
 				if ( v->GetVal() )
@@ -1997,7 +1997,7 @@ IntrusivePtr<TableVal> TableVal::LookupSubnetValues(const SubNetVal* search)
 
 		if ( entry )
 			{
-			if ( attrs && attrs->FindAttr(ATTR_EXPIRE_READ) )
+			if ( attrs && attrs->Find(ATTR_EXPIRE_READ) )
 				entry->SetExpireAccess(network_time);
 			}
 		}
@@ -2201,7 +2201,7 @@ ListVal* TableVal::ConvertToPureList() const
 
 Attr* TableVal::FindAttr(attr_tag t) const
 	{
-	return attrs ? attrs->FindAttr(t) : nullptr;
+	return attrs ? attrs->Find(t).get() : nullptr;
 	}
 
 void TableVal::Describe(ODesc* d) const
@@ -2714,7 +2714,7 @@ RecordVal::RecordVal(IntrusivePtr<RecordType> t, bool init_fields) : Val(std::mo
 	for ( int i = 0; i < n; ++i )
 		{
 		Attributes* a = rt->FieldDecl(i)->attrs.get();
-		Attr* def_attr = a ? a->FindAttr(ATTR_DEFAULT) : nullptr;
+		Attr* def_attr = a ? a->Find(ATTR_DEFAULT).get() : nullptr;
 		auto def = def_attr ? def_attr->GetExpr()->Eval(nullptr) : nullptr;
 		const auto& type = rt->FieldDecl(i)->type;
 
@@ -2728,7 +2728,7 @@ RecordVal::RecordVal(IntrusivePtr<RecordType> t, bool init_fields) : Val(std::mo
 				def = std::move(tmp);
 			}
 
-		if ( ! def && ! (a && a->FindAttr(ATTR_OPTIONAL)) )
+		if ( ! def && ! (a && a->Find(ATTR_OPTIONAL)) )
 			{
 			TypeTag tag = type->Tag();
 
diff --git a/src/Var.cc b/src/Var.cc
index 4ec2b6b60d..19053bc489 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -412,21 +412,21 @@ static void transfer_arg_defaults(RecordType* args, RecordType* recv)
 		TypeDecl* args_i = args->FieldDecl(i);
 		TypeDecl* recv_i = recv->FieldDecl(i);
 
-		Attr* def = args_i->attrs ? args_i->attrs->FindAttr(ATTR_DEFAULT) : nullptr;
+		const auto& def = args_i->attrs ? args_i->attrs->Find(ATTR_DEFAULT) : nullptr;
 
 		if ( ! def )
 			continue;
 
 		if ( ! recv_i->attrs )
 			{
-			std::vector<IntrusivePtr<Attr>> a{{NewRef{}, def}};
+			std::vector<IntrusivePtr<Attr>> a{def};
 			recv_i->attrs = make_intrusive<Attributes>(std::move(a),
 			                                           recv_i->type,
 			                                           true, false);
 			}
 
-		else if ( ! recv_i->attrs->FindAttr(ATTR_DEFAULT) )
-			recv_i->attrs->AddAttr({NewRef{}, def});
+		else if ( ! recv_i->attrs->Find(ATTR_DEFAULT) )
+			recv_i->attrs->AddAttr(def);
 		}
 	}
 
@@ -523,7 +523,7 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 					{
 					auto f = args->FieldDecl(i);
 
-					if ( f->attrs && f->attrs->FindAttr(ATTR_DEFAULT) )
+					if ( f->attrs && f->attrs->Find(ATTR_DEFAULT) )
 						{
 						reporter->PushLocation(args->GetLocationInfo());
 						reporter->Warning(