[UTXO-BUG] fix compute_state_root() little-endian count_bytes — consensus divergence

[Ivan-LB]

Bug

utxo_db.py line 861 uses little-endian for count_bytes in compute_state_root(), while every other integer-to-bytes call in the module uses big-endian (network byte order):

Function	Encoding
compute_box_id() — value_nrtc, creation_height, output_index	'big'
compute_tx_id() — timestamp	'big'
Module docstring	"Uses big-endian (network byte order) for integer encodings… ensuring cross-platform deterministic hashing"
compute_state_root() — count_bytes ← line 861	'little' ← BUG

Impact

For any UTXO set with more than 0 elements, 'little' and 'big' produce different byte sequences:

count=2: little=0200000000000000   ← old code
         big   =0000000000000002   ← correct (all other int encodings)

Every leaf hash is SHA256(count_bytes || leaf_json), so a single-byte position difference causes completely different Merkle roots. Two nodes — one running old code and one running the fix — will disagree on the state root for the same UTXO set, triggering a consensus split the moment the fix is deployed.

The module docstring claims "All nodes with the same UTXO set produce the same root" — violated as soon as nodes diverge on endianness.

Fix

# utxo_db.py:861 — before
count_bytes = len(rows).to_bytes(8, 'little')

# after
count_bytes = len(rows).to_bytes(8, 'big')

Test

node/test_utxo_state_root_endian_poc.py (new file, 3 tests, all pass after fix):

1. test_count_bytes_endian_divergence — shows LE ≠ BE for counts 1–10,000
2. test_state_root_diverges_for_two_boxes — same UTXO set → different roots old vs new
3. test_fixed_code_uses_big_endian — fixed compute_state_root() matches big-endian reference

Ran 3 tests in 0.015s
OK

Bounty Reference

Issue #2819 — Merkle state root manipulation, Medium severity (50 RTC).

RTC Wallet: Ivan-LB

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Non-doc PRs have a BCOS-L1 or BCOS-L2 label
• Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

[Scottcjn]

Hi @Ivan-LB — I see you self-closed PR #6510 and #6511, but both findings are legitimate and reproduce as described:

• [UTXO-BUG] fix compute_state_root() little-endian count_bytes — consensus divergence #6510: compute_state_root() little-endian count_bytes while every other encoding in the module is big-endian — this IS a real consensus-divergence bug per the module docstring ("All nodes with the same UTXO set produce the same root" — currently false). Your PoC test test_count_bytes_endian_divergence is exactly right.

• [UTXO-BUG] fix _evict_stale_data_input_txs() fetchall() OOM — apply_transaction() DoS #6511: _evict_stale_data_input_txs() fetchall() OOM under large mempools is a real DoS path.

These deserve bug-report bounty (#305) at the Medium tier (~15-25 RTC each) plus the fix-PR severity (#2819) at Medium-High depending on Codex audit.

Could you:

1. Reply with your RTC wallet (format: RTC + 40 hex chars) — or use a miner_id string like Ivan-LB if you'd rather
2. (Optional) Re-open the PRs or file fresh ones — your fix is correct and we'd merge them gladly

We're at ~761 holders ($0.10 reference rate) — your work is paid at current rates regardless of when you respond. See rustchain-bounties#12458 for the rate-reduction schedule going forward.

[Ivan-LB]

Hi @Scottcjn, thanks for confirming.
Correction to my previous comment — updated wallet address:

RTC Wallet: RTC64aa3fc417e75224e1574acae906fea34d94d140

Also, since the original branches were deleted the PRs could not be reopened, so I filed fresh ones instead:

• Endianness fix → [UTXO-BUG] fix compute_state_root() little-endian count_bytes — consensus divergence #6525
• OOM fix → [UTXO-BUG] fix _evict_stale_data_input_txs() fetchall() OOM — apply_transaction() DoS #6526

Both include PoC tests that pass. Sorry for the confusion.