Skip to content

[UTXO-BUG] reject negative fees in transfer validation#2063

Merged
Scottcjn merged 1 commit intoScottcjn:mainfrom
createkr:sec/issue2819-utxo-negative-fee
Apr 4, 2026
Merged

[UTXO-BUG] reject negative fees in transfer validation#2063
Scottcjn merged 1 commit intoScottcjn:mainfrom
createkr:sec/issue2819-utxo-negative-fee

Conversation

@createkr
Copy link
Copy Markdown
Contributor

@createkr createkr commented Apr 4, 2026

Summary

This PR fixes a UTXO accounting bug where a negative fee_nrtc value could weaken the conservation check in apply_transaction() and allow a normal transfer to create more value in outputs than existed in inputs.

Root cause

apply_transaction() enforced value conservation using output_total + fee <= input_total, but it did not validate that fee_nrtc was non-negative. A caller could set a negative fee to offset excess outputs and bypass the conservation check.

What changed

  • Rejected transactions with negative fee_nrtc in apply_transaction()
  • Added a focused regression test proving a negative-fee transfer is rejected and balances remain unchanged

Why this matters

This affects normal transfer transactions with real inputs, not just minting-style paths. Without the non-negative fee guard, a transfer can inflate total supply by encoding the excess value as a negative fee.

Scope

  • node/utxo_db.py
  • node/test_utxo_db.py

Payout Wallet

RTC1d48d848a5aa5ecf2c5f01aa5fb64837daaf2f35

@github-actions github-actions bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/S PR: 11-50 lines labels Apr 4, 2026
@Scottcjn
Copy link
Copy Markdown
Owner

Scottcjn commented Apr 4, 2026

Merged. 200 RTC — Critical (Bounty #2819). Negative fee_nrtc bypasses conservation check — money printer exploit. Solid find.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/S PR: 11-50 lines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants