Skip to content

Bounty | decimal.Decimal Precision Overflow #5

Description

@SerchCan

Hi there, this is a just silly bug, when you overflow the precision point from the decimal.Decimal library you get a false positive or Precision bug as stated on the page.

Well at first i wasn't going to report it but i remembered some services charge an absurd level of cents by data like in the GCP console for on premise actions.

Image

You can see on the image the first one bypassed the rule while the other one worked as expected as i reduced the precision on it.

This can be fixed by checking the length of the transaction amount before converting, or by augmenting the precision from the library,
but this last one can lead to more processing, wait time and it relies a lot more on the hardware.

# Set precision to 100 significant digits
decimal.getcontext().prec = 100

the code is the following:

from decimal import Decimal
from agentshield import SpendControlEngine

engine = SpendControlEngine()
# A transaction your agent wants to make
APPROVED_transaction = {
    "amount": 1.0000000000000001,
    "merchant": "openai-api",
    "category": "llm_inference",
    "agent_id": None,
    "timestamp": "2026-08-10T10:00:00Z",
}

BLOCK_transaction = {
    "amount": 1.000000000000001,
    "merchant": "openai-api",
    "category": "llm_inference",
    "agent_id": None,
    "timestamp": "2026-08-10T10:00:00Z",
}
# Your spend-control rules
rules = [
    {"id": "r1", "type": "transaction_limit", "priority": 1, "params": {"max_amount": 1},                     "action": "BLOCK"},
    {"id": "r2", "type": "daily_total",       "priority": 2, "params": {"max_daily": 10},                     "action": "BLOCK"},
    {"id": "r3", "type": "velocity",          "priority": 3, "params": {"window_minutes": 60, "max_count": 10}, "action": "FLAGGED"},
]
# Prior transactions today (for daily_total and velocity checks)
prior_transactions = []

# Evaluate — returns in <1ms
result = engine.evaluate(APPROVED_transaction, rules, prior_transactions)
print(result["decision"])  # APPROVED expected BLOCKED
print(result["reason"])    # All rules pased (WRONG)

result = engine.evaluate(BLOCK_transaction, rules, prior_transactions)
print(result["decision"])  # BLOCKED
print(result["reason"])    # Transaction amount $1.0000000000000001 exceeds limit of $1.00

Best regards

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions