opensanctions / opensanctions/opensanctions

helpers: apply_number's _float_str zeroes small values (%.2f) and formats the same number two ways

Open
#4,945 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug zavod
Dominant language
Python
Stars
810
Forks
187
Avg merge
1d 7h
Merged PRs (30d)
133

Description

Found in a systematic audit of the zavod helper library (2026-07-17). Verified by repro against zavod/zavod/helpers/numbers.py:13-17,58.

_float_str formats non-integral floats with a hardcoded %.2f, and the Decimal branch always emits 2 decimals:

  • Any nonzero value < 0.005 is stored as "0.00" — a nonzero amount published as zero. apply_number(wallet, "amountUsd", 0.004)"0.00"; via the string-parse path "0.005""0.01".
  • The same number gets two representations depending on input type: Decimal("5")"5.00" but float 5.0"5" — inconsistent values for identical quantities, which matters for statement dedup.

The rounding also silently discards precision on legitimate high-precision values (crypto amounts, coordinates-adjacent measurements) with no warning and no way to opt out.

Blast radius

The 5 crawlers using apply_number (abuja/tokyo/black_sea MOU tonnage, _global/interpol height/weight, _global/ransomwhere balances). ransomwhere's balanceUSD float amounts are the realistic hit — sub-cent balances become "0.00".

Fix direction

Preserve significant digits instead of fixed 2-dp (e.g. repr-style shortest round-trip formatting, or a per-call precision parameter); make float and Decimal paths produce identical strings for equal values. Related: the upstream parse defects feeding this formatter are tracked in opensanctions/followthemoney#331.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in zavod/zavod/helpers/numbers.py at lines 13–17 and 58, and reproduce the apply_number examples for float and Decimal inputs. Then inspect the five listed crawler call sites, especially ransomwhere balanceUSD, to understand affected values. Done means nonzero small values retain precision and equal float and Decimal quantities receive identical string representations.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, data
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.