[UTXO-BUG] CRIT-2: Dual-write decimal mismatch inflates account model 10x

[ArokyaMatthew]

Vulnerability Class

Critical — Fund inflation via precision error (200 RTC bounty)

The Bug

The UTXO model uses UNIT = 100_000_000 (10^8, 8 decimal places). But the dual-write path in utxo_endpoints.py line 320 converts to the account model using 1_000_000_000 (10^9, 9 decimal places):

# UTXO model (correct):
amount_nrtc = int(amount_rtc * UNIT)          # 10 RTC → 1,000,000,000

# Dual-write to account model (WRONG):
amount_i64 = int(amount_rtc * 1_000_000_000)  # 10 RTC → 10,000,000,000 (10x!)

Every transfer with dual_write=True credits 10× the correct amount in the account-model balance table.

Impact
Account model shows 10× more funds than actually exist in UTXOs
Integrity checks (/utxo/integrity) will always fail once dual-write is enabled
When UTXO becomes authoritative, the mismatch causes phantom balances or masks real bugs
Fix
Use amount_nrtc (already correctly computed from amount_rtc * UNIT) instead of re-converting from the float with the wrong multiplier.

Test Added
TestDualWriteConsistency.test_dual_write_amount_matches_utxo — enables dual-write, transfers 60 RTC, verifies account model gets exactly 60 * UNIT (not 60 * 10^9)
All 16 endpoint tests pass.

Files Changed
node/utxo_endpoints.py — 1 line changed (fixed multiplier)
node/test_utxo_endpoints.py — 88 lines added (new test class)
Ref: Bounty #2819

MY WALLET IS aroky-x86-miner 

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Your PR has a BCOS-L1 or BCOS-L2 label
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

[zhuzhushiwojia]

Great security audit work! These fixes are critical for the protocol.

[Scottcjn]

Closing as duplicate of createkr #2096 (already merged), which fixed the same dual-write unit mismatch (1e9 → correct UNIT).

25 RTC independent discovery credit — you found the same bug independently, which validates the severity. Good eye.

Wallet: ArokyaMatthew | Reason: independent discovery bounty #2819 CRIT-2 (dupe of #2096)