AntFleet

Disagreement · d121d4bf-anthropic-7

format_units zfill off-by-one for amounts equal to 10^decimals

solo Opus
repo a16d2030·PR #4·reviewed 1 week ago

Opus finding

format_units zfill off-by-one for amounts equal to 10^decimals

lowbugmedium
  • symbiosis/scripts/symbiosis-quote.py:26-30
The logic mostly works but: for `amount_raw='0'` with decimals=6, s='0000000' (7 chars), int_part='0', frac_part='' -> returns '0' (ok). For very large amounts, `float()`-free formatting is good. However, when `amount_raw` is non-digit (e.g., '' default), `'0'.zfill(7)` is fine but `int(integer+frac)` in to_smallest_units would already have rejected it. Lower-severity concern: if amount_raw contains a leading '+' or scientific notation (the API generally returns canonical strings, so this is unlikely), parsing breaks. Severity low because Symbiosis returns canonical integer strings.

Recommendation

Tighten input validation in format_units (require all digits) and document the assumption.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.