GHSA-j622-qffp-rc27

Summary

VerificationEngine.verify_math() (src/qwed_new/core/verifier.py ~L128) evaluates the expression with expr.evalf(), whose default precision is 15 significant digits, then quantizes to 6 decimals and compares with the claimed value. For values with more than 15 significant digits, the computed value is rounded before comparison, so:

Impact

/verify/math, ControlPlane.process_natural_language and consensus math accept off-by-small-amount claims on large values and reject correct ones. Financial integrations that use minor units (paise/cents/wei) commonly exceed 15 digits. An attacker or a faulty LLM can get an incorrect total attested as VERIFIED.

Patches

• If expr is an exact Integer/Rational, compare exactly with Decimal(str(claimed)) / Rational, with no evalf.
• Otherwise evaluate with evalf(n=max(30, digits(claimed) + 10)) and fail closed (BLOCKED) when the precision needed cannot be established.
• Regression tests: the table above plus negative/rational variants.

Workarounds

Keep values below 15 significant digits (e.g. compare in major units) or re-verify large values with exact integer arithmetic.