[UTXO-BUG] CRITICAL: Token conservation bypass allows arbitrary asset creation

[BossChaos]

Vulnerability Summary

Type: Asset creation bypass (Critical severity)
Reward Tier: 200 RTC (Critical - Fund creation equivalent for tokens)
File: node/utxo_db.py - apply_transaction() method

Description

The UTXO layer does not enforce token conservation, allowing attackers to mint arbitrary tokens from nothing.

Attack Scenario

1. Attacker consumes a UTXO with NO tokens
2. Attacker creates outputs with arbitrary tokens in tokens_json
3. apply_transaction() accepts the transaction because it only checks nRTC conservation

Proof of Concept

See tests/test_utxo_token_conservation.py - failing test cases demonstrate:

1. Token creation from nothing (test_token_creation_from_nothing)

   • Input UTXO contains 0 tokens
   • Output UTXOs contain arbitrary tokens (fake NFTs, counterfeit stablecoins)
   • Transaction is accepted - violates UTXO invariant

2. Token destruction without validation (test_token_destroy_without_spending)

   • Tokens can be destroyed by omitting them from outputs
   • No conservation check prevents asset destruction

3. Mempool lacks token checks (test_mempool_allows_token_creation)

   • Mempool can be flooded with token-creation transactions

Impact

• Counterfeit NFT creation: Attackers can mint fake NFTs
• Fake stablecoins: Create arbitrary amounts of tokenized assets
• UTXO invariant violation: Core blockchain security assumption broken
• Economic damage: Token holders cannot trust token scarcity

Required Fix

Add token balance tracking to:

1. apply_transaction() - enforce input tokens == output tokens for each token_id
2. mempool_add() - reject transactions that violate token conservation
3. Genesis migration - validate initial token distribution

Test Case

Run: python3 tests/test_utxo_token_conservation.py -v

Tests currently PASS (demonstrating the bug exists) and should FAIL after the fix is applied.

[Scottcjn]

Closing as superseded by #3935 which contains:

• The same tests/test_utxo_token_conservation.py (your test file in this PR)
• An ADDITIONAL test file tests/test_utxo_additional_vulns.py (+737 lines)
• The actual fixes in node/utxo_db.py (+92/-12) and node/rustchain_v2_integrated_v2.2.1_rip200.py (+65/-4)

#3935 is the comprehensive PR that includes everything here plus the actual remediation code. Reviewing + paying against #3935. No need for two separate payouts when one PR does the full job.