Open-source runtime verification for AI, licensed under Apache-2.0.
QWED
Contact

Type to search pages, engines and advisories.

    Looking for API details?Search the docs

    GHSA-j622-qffp-rc27

    verify_math returns VERIFIED for incorrect results on large numbers due to 15-digit evaluation precision

    medium · 6.5Published 9 October 2026

    Summary

    VerificationEngine.verify_math() (src/qwed_new/core/verifier.py ~L128) evaluates the expression with expr.evalf(), whose default precision is 15 significant digits, then quantizes to 6 decimals and compares with the claimed value. For values with more than 15 significant digits, the computed value is rounded before comparison, so:

    Expression Claimed Result Correct
    10000000000000001 10000000000000000 VERIFIED CORRECTION_NEEDED
    10000000000000001 10000000000000001 CORRECTION_NEEDED VERIFIED
    2**64 18446744073709551616 CORRECTION_NEEDED VERIFIED

    Impact

    /verify/math, ControlPlane.process_natural_language and consensus math accept off-by-small-amount claims on large values and reject correct ones. Financial integrations that use minor units (paise/cents/wei) commonly exceed 15 digits. An attacker or a faulty LLM can get an incorrect total attested as VERIFIED.

    Patches

    • If expr is an exact Integer/Rational, compare exactly with Decimal(str(claimed)) / Rational, with no evalf.
    • Otherwise evaluate with evalf(n=max(30, digits(claimed) + 10)) and fail closed (BLOCKED) when the precision needed cannot be established.
    • Regression tests: the table above plus negative/rational variants.

    Workarounds

    Keep values below 15 significant digits (e.g. compare in major units) or re-verify large values with exact integer arithmetic.

    Affected and fixed

    Package
    qwed
    Affected
    <= 7.2.1
    Fixed in
    7.2.2
    Severity
    medium · 6.5
    Weakness
    CWE-697 Incorrect Comparison
    CWE-1339 Insufficient Precision or Accuracy of a Real Number
    View on GitHub

    All advisories