[CLEAN] 6 UTXO Security Vulnerabilities + PoC Tests (Supersedes #4014 & #3935)

[BossChaos]

Summary

This is a clean, focused PR containing ONLY the UTXO vulnerability tests and minimal fixes. It supersedes #4014 and #3935 to avoid review noise and overlap confusion.

Vulnerabilities Covered (Bounty #2819)

Severity	Vulnerability	PoC Test
Critical	_allow_minting bypass	test_allow_minting_bypass
Critical	TOCTOU double-spend	test_toctou_double_spend
High	Coinbase cap overflow	test_coinbase_cap_overflow
High	tx_id fee manipulation	test_tx_id_fee_collision
Medium	Missing box_id validation	test_missing_box_id_validation
Medium	Dust output attack	test_dust_output_attack

Files Changed

• node/utxo_db.py: 1-line fix (include fee in tx_id)
• tests/test_utxo_bounty_vulnerabilities.py: 699 lines, 16 pass + 1 expected fail

Note

• I will close [UTXO-BUG] 6 Security Vulnerabilities in UTXO Implementation (2 Critical, 1 High, 2 Medium) #4014 and [READY FOR REVIEW] Fix 3 Critical UTXO Security Vulnerabilities (Token Conservation, tx_id Collision, Mempool Spoofing) #3935 after this is reviewed to prevent duplicate payouts.
• All tests pass locally. Expected fail demonstrates the TOCTOU race condition.

Wallet: RTC6d1f27d28961279f1034d9561c2403697eb55602