Decimal amounts stored as integers (cents), never floats
Why it matters
IEEE 754 floating-point arithmetic cannot represent most decimal fractions exactly. Storing 19.99 as a float in PostgreSQL or MongoDB introduces rounding errors that compound across thousands of transactions — a classic fintech data-integrity failure cited under CWE-681 (Incorrect Conversion Between Numeric Types) and CWE-682 (Incorrect Calculation). At scale, accumulated errors produce off-by-one-cent discrepancies in statements, reconciliation failures, and potential regulatory exposure under GAAP precision requirements. Integer cent storage eliminates the issue entirely: 1999 is exact in every language and database type system.
Severity rationale
Critical because floating-point accumulation in monetary storage produces unbounded rounding drift that corrupts financial records and triggers compliance failures.
Remediation
Change all monetary database columns to integer types and add an explicit cents-conversion step in the API layer before any write. Reference prisma/schema.prisma for schema changes.
// prisma/schema.prisma
model Transaction {
id String @id @default(cuid())
amountCents Int // never Float or Decimal
currency String
}
// src/lib/currency.ts
export function toCents(decimalString: string): number {
return Math.round(parseFloat(decimalString) * 100);
}
export function fromCents(cents: number): string {
return (cents / 100).toFixed(2);
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Financial Form Validation Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-681 — Incorrect Conversion between Numeric Types
- cwe · CWE-682 — Incorrect Calculation
Taxons
History
- 2026-04-18·v1.0.0·Initial import from finserv-form-validation·automated