Some simulations incorrectly reported portfolio depletion

Summary

When triggered, the bug increased the reported probability of failure and reduced reported ending balances. No customer inputs were changed, no customer data was exposed, and account security was not affected. The incident was limited to incorrect hypothetical simulation results.

We deployed a fix on July 18, audited saved simulations from the full exposure window, and reran the affected simulations belonging to signed-in customers. We are sorry that we presented incorrect results and did not detect the defect before those results reached customers.

Customer impact

The production exposure window contained 160 saved simulation runs. Our conservative audit placed 112 in the remediation set because their saved inputs and original engine version could reproduce the defect. This does not prove that every original 10,000-path run contained an affected path; we treated each result as potentially affected rather than risk leaving an incorrect result in place.

Direct evidence confirmed the defect in 40 original simulation executions, and another 11 stored records had copied affected results. A controlled same-path replay removed ordinary Monte Carlo noise from the comparison.

Among susceptible saved configurations, the median overstatement of failure probability was 0.44 percentage points. Twenty-five saved runs were overstated by at least 10 percentage points, and the largest observed overstatement was 38.82 percentage points.

We reran and replaced 37 historical results belonging to four signed-in customer accounts. After replacement, none of their current saved scenarios retained an affected result. Two current scenarios on one account changed materially, and we are contacting that customer directly.

We found no customer-owned public result page linked to an affected source run. Some pages published by Retirement Lab itself were connected to susceptible runs; we will add corrections where those results were shared publicly.

What happened

Floating-point arithmetic can leave a tiny remainder after subtracting large values. The affected code compared that remainder with a fixed threshold of one billionth of a currency unit. At large transaction and portfolio scales, normal numerical error could exceed the threshold.

The engine then replaced the path’s legitimate portfolio balance with the tiny negative remainder and marked the path depleted. Large required minimum distributions and their associated tax flows made the bug easier to trigger, but the US tax model was not the root cause and another country’s tax rules were not applied.

The defect was not limited to unusually large starting portfolios: 86 of 103 susceptible saved configurations started below $5 million.

Why we did not catch it earlier

Our tests did not include the system-level invariants needed to detect this failure mode. We also retained only 30 sampled timelines from a normal 10,000-path run, did not persist each run’s random seed, and did not record the exact simulation engine release with older results.

Resolution

We replaced the fixed absolute threshold with a scale-aware tolerance. A remainder below one cent, or below the expected floating-point resolution for the values involved, is now treated as arithmetic noise. Genuine depletion is still reported.

New regression tests cover the original failure mode, agreement between summary and detailed calculations, the invariant that adding wealth cannot increase failure probability, and preservation of genuine shortfalls.

Follow-up work

We deployed the fix, added regression and invariant coverage, audited the full exposure window, reran affected signed-in customer results, and preserved private before-and-after records.

Remaining work is to persist deterministic random seeds, persist the exact simulation engine release with every result, and finish direct customer communication.

Questions

If you have questions about a Retirement Lab result generated during the incident window, contact [email protected].