No cumulative floating-point errors in multi-step transactions
Why it matters
Floating-point errors in a single step are small; across a multi-step chain they compound unpredictably. A refund pipeline that subtracts a fee, applies a discount, and then taxes the result in float arithmetic will produce a different final amount depending on the order of operations — a determinism failure that makes reconciliation impossible. CWE-682 covers incorrect calculation; ISO 25010 functional-correctness requires financial outputs to be exact. Even a one-cent error per transaction becomes a material accounting discrepancy at tens of thousands of monthly transactions.
Severity rationale
High because floating-point intermediates in chained calculations produce non-deterministic results that break financial reconciliation and audit trails.
Remediation
Refactor all multi-step calculation chains to operate in integer cents from start to finish. Convert to cents once at the entry point and convert back to decimal only at display time.
// src/lib/finance.ts — integer arithmetic throughout
export function calculateRefund(
originalCents: number,
feeCents: number,
discountCents: number
): number {
// All intermediates remain integers
const afterFee = originalCents - feeCents;
const afterDiscount = afterFee - discountCents;
return Math.max(0, afterDiscount); // never negative
}
Search src/ for any pattern matching balance += or total -= where the variable is initialized as a float and replace with integer cent equivalents.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Financial Form Validation Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-682 — Incorrect Calculation
- iso-25010:2011 · functional-correctness — Functional Suitability — Functional Correctness
Taxons
History
- 2026-04-18·v1.0.0·Initial import from finserv-form-validation·automated