Self-Audit: bridge_api.py + utxo_db.py — 6 security findings (BossChaos)

[BossChaos]

Self-Audit Submission — BossChaos

Two audit packets for the #6460 Self-Audit bounty:

Audit 1: node/bridge_api.py (876 lines, SHA: 59ef682)

#	Severity	Title
1	high	Cross-chain bridge deposits skip balance lock when admin_initiated=True — phantom deposits possible
2	high	update_external endpoint has no replay protection — attacker can alter transfer status via race condition
3	medium	Bridge transfer amount stored as REAL (floating point) causes precision loss in cross-chain accounting

Audit 2: node/utxo_db.py (913 lines, SHA: fe2cdd7)

#	Severity	Title
1	high	Transaction ID malleability — outputs excluded from tx_id hash when inputs are present
2	medium	Exception handling swallows critical database errors — potential silent data corruption
3	medium	Mempool input tracking not cleaned up on transaction abort — UTXOs permanently blocked

---

Wallet: RTC6d1f27d28961279f1034d9561c2403697eb55602

Full audit reports with reproduction steps and known-failures attached.

[Scottcjn]

Self-Audit deep-verify (#6460 rubric): PASS.

Clean packet: 2 audits (bridge_api.py + utxo_db.py), 6 findings combined. File:line citations are accurate, severity ratings calibrated, remediations actionable.

Payout: 20 RTC.

• pending_id: 1314
• tx_hash: d24c59d3ac0dc92851f97aee7d91b385
• to: RTC6d1f27d28961279f1034d9561c2403697eb55602
• 24h auto-void window standard

Merging. Pre-existing test workflow failure (22s, infra-flake — same failure across all PRs in this batch) is unrelated to your audit content.

— Scott