VBC-940: float-currency-arithmetic

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .astro
Scope: source code only, ignoring anything inside strings and comments
Supersedes: VBC-007 on the same line
Tags: security correctness ai-error

What it reports

Floating-point arithmetic on monetary value '{match}' at line {line}. Float imprecision causes rounding errors in financial calculations (e.g. 0.1 + 0.2 != 0.3). Use integer cents/minor units or a dedicated decimal library (decimal.js, big.js, Python's Decimal) for all money math.

Flagged

const total = price * 0.22;

Not flagged

const totalCents = priceCents * 22;

const wet = amount * 0.5;

const pan = balance * 0.5;

const g = rate * 0.35;

Pattern

\b(?:(?:price|cost|fee|fees|tax|subtotal|payment|invoice|salary|refund|charge)(?![a-z])|[a-z_$]+(?:Price|Cost|Fee|Fees|Tax|Subtotal|Payment|Invoice|Salary|Refund|Charge)(?![a-z]))[A-Za-z_$]*\s*[*/+\-]=?\s*0\.[0-9]|\b(?:(?:price|cost|fee|fees|tax|subtotal|payment|invoice|salary|refund|charge)(?![a-z])|[a-z_$]+(?:Price|Cost|Fee|Fees|Tax|Subtotal|Payment|Invoice|Salary|Refund|Charge)(?![a-z]))[A-Za-z_$]*\s*=\s*[a-zA-Z_$][\w$]*\s*[*/]\s*[a-zA-Z_$][\w$]*