Incorrect Calculation occurs when software performs a mathematical operation and produces a wrong result due to logic errors, type mismatches, overflow, or…
Incorrect Calculation occurs when software performs a mathematical operation and produces a wrong result due to logic errors, type mismatches, overflow, or precision loss. These miscalculations can cascade into serious problems: wrong access decisions, resource exhaustion, memory corruption, or financial discrepancies. Unlike overflow/underflow (which are specific numeric boundary cases), this weakness covers any arithmetic mistake that breaks the intended logic.
Incorrect calculations typically stem from one of several patterns: using the wrong operator or operand, mixing incompatible numeric types without proper conversion, losing precision during floating-point arithmetic, or failing to account for edge cases (zero, negative numbers, very large values). Developers may also misunderstand the order of operations, apply integer division where floating-point is needed, or forget to validate intermediate results. The error is often subtle—the code "looks right" but produces wrong answers under certain inputs.
A miscalculation in access control logic might grant permissions to the wrong user. In financial systems, rounding errors or incorrect interest calculations compound over time. Resource allocation bugs can cause denial of service (exhausting memory or CPU by miscalculating limits). In safety-critical code, wrong sensor readings or control calculations can cause physical harm. Even seemingly minor math errors in authentication tokens, rate-limiting counters, or privilege checks can be exploited to bypass security controls.
def calculate_discount(price, discount_percent):
# Intended: apply discount as a percentage
# Bug: subtracts the percentage value directly instead of calculating percentage of price
discounted = price - discount_percent
return discounted
def check_access(user_id, max_users):
# Bug: uses integer division, losing fractional part
# If max_users=10 and user_id=15, result is 1 (true) instead of 0 (false)
return user_id / max_usersWhy it's vulnerable:
The first function subtracts a percentage as if it were a fixed amount. The second uses division instead of modulo, producing a wrong boolean result. Both produce incorrect outputs that downstream code relies on.
def calculate_discount(price, discount_percent):
# Correct: calculate the discount amount, then subtract
discount_amount = price * (discount_percent / 100.0)
discounted = price - discount_amount
return discounted
def check_access(user_id, max_users):
# Correct: use modulo to check if user_id is within valid range
return user_id < max_users<?php
function calculate_storage_quota($base_gb, $bonus_percent) {
// Bug: adds percentage value directly instead of calculating percentage of base
$total = $base_gb + $bonus_percent;
return $total;
}
function validate_age($birth_year) {
// Bug: uses subtraction instead of calculating actual age
// If birth_year=2000 and current year is 2024, result is 24 (correct by accident)
// but logic is wrong and fails in other years
$age = 2024 - $birth_year;
return $age >= 18;
}
?>Why it's vulnerable:
The first function adds a percentage as a fixed number instead of calculating it relative to the base. The second hardcodes the current year, making the calculation fail when the year changes.
<?php
function calculate_storage_quota($base_gb, $bonus_percent) {
// Correct: calculate bonus as a percentage of base, then add
$bonus_gb = $base_gb * ($bonus_percent / 100);
$total = $base_gb + $bonus_gb;
return $total;
}
function validate_age($birth_year) {
// Correct: use current year dynamically
$current_year = (int) date('Y');
$age = $current_year - $birth_year;
return $age >= 18;
}
?>Look for unexpected behavior in features that depend on math: users getting wrong discounts or quotas, access being granted or denied incorrectly, rate limits not working as intended, or resource usage spikes that don't match expected load. Audit logs showing permission grants to unexpected users, or financial reports with unexplained discrepancies, may also indicate a calculation bug. Test your critical calculations with boundary values and compare results against a manual or external reference.
