opensanctions / opensanctions/opensanctions
helpers: apply_number's _float_str zeroes small values (%.2f) and formats the same number two ways
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 810
- Forks
- 187
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 133
Description
Found in a systematic audit of the zavod helper library (2026-07-17). Verified by repro against zavod/zavod/helpers/numbers.py:13-17,58.
_float_str formats non-integral floats with a hardcoded %.2f, and the Decimal branch always emits 2 decimals:
- Any nonzero value < 0.005 is stored as
"0.00"— a nonzero amount published as zero.apply_number(wallet, "amountUsd", 0.004)→"0.00"; via the string-parse path"0.005"→"0.01". - The same number gets two representations depending on input type:
Decimal("5")→"5.00"butfloat 5.0→"5"— inconsistent values for identical quantities, which matters for statement dedup.
The rounding also silently discards precision on legitimate high-precision values (crypto amounts, coordinates-adjacent measurements) with no warning and no way to opt out.
Blast radius
The 5 crawlers using apply_number (abuja/tokyo/black_sea MOU tonnage, _global/interpol height/weight, _global/ransomwhere balances). ransomwhere's balanceUSD float amounts are the realistic hit — sub-cent balances become "0.00".
Fix direction
Preserve significant digits instead of fixed 2-dp (e.g. repr-style shortest round-trip formatting, or a per-call precision parameter); make float and Decimal paths produce identical strings for equal values. Related: the upstream parse defects feeding this formatter are tracked in opensanctions/followthemoney#331.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in zavod/zavod/helpers/numbers.py at lines 13–17 and 58, and reproduce the apply_number examples for float and Decimal inputs. Then inspect the five listed crawler call sites, especially ransomwhere balanceUSD, to understand affected values. Done means nonzero small values retain precision and equal float and Decimal quantities receive identical string representations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, data
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100