[Bug] coin_select() largest-first fallback still returns >20 inputs on equal-value UTXOs

[kitwongpixel]

Summary

node/utxo_db.py::coin_select() documents a fallback to largest-first when smallest-first selection uses more than 20 inputs, but the fallback still returns more than 20 inputs when the UTXOs all have the same value.

This means the heuristic does not actually reduce input count in an important edge case, so transaction construction can still emit oversized multi-input spends even though the code claims it is trying to switch to a fewer-input strategy.

Affected code

• node/utxo_db.py:1444-1489
• node/utxo_endpoints.py:570 (calls coin_select() directly when building wallet transfers)

Reproduction

Run this from the repo root:

python3 - <<'PY'
import sys
sys.path.insert(0, '/root/rustchain/node')
from utxo_db import coin_select

utxos = [{'value_nrtc': 1} for _ in range(25)]
selected, change = coin_select(utxos, 21)
print('selected_inputs=', len(selected))
print('change=', change)
PY

Observed output on current main:

selected_inputs= 21
change= 0

Expected behavior

If the function says it will restart with largest-first when the selection exceeds 20 inputs, the fallback should actually reduce the input count or fail cleanly for this edge case.

Actual behavior

When all UTXOs have equal value, smallest-first and largest-first produce the same ordering, so the fallback still returns 21 inputs for a 21-RTC target.

Impact

• The input-count heuristic does not work for equal-value UTXO sets.
• Wallets with many same-sized UTXOs can still produce large transactions.
• That increases transaction size and makes the intended anti-bloat guard ineffective in a common consolidation scenario.

Notes

I searched for an existing open issue for this specific coin-selection edge case and did not find one.

[github-actions]

Welcome to RustChain! Thanks for opening your first issue.

New here? Check out these resources:

• CONTRIBUTING.md — how to earn RTC bounties
• Good First Issues — easy starter tasks (5-10 RTC)
• Bounty Board — all open bounties

Earn RTC tokens by contributing code, docs, or security fixes. Every merged PR gets paid!

1 RTC = $0.10 USD | pip install clawrtc to start mining

[Scottcjn]

Confirmed — this reproduces on main. With 25 equal-value UTXOs and a target of 21, smallest-first and largest-first produce identical orderings, so the documented largest-first fallback never reduces the input count and still returns 21 inputs. Clean, specific report with a runnable repro. 👍

Heads up for triage/reviewers: there are two open PRs targeting this same bug —

• fix: [Bug] coin_select() largest-first fallback still returns >20 #6831 (@HMS091, non-draft, size/XS) — posted first
• [codex] cap coin_select fallback inputs #6834 (@kitwongpixel, draft, size/S) — from this issue's reporter, includes regression tests for the equal-value edge case

Per our one-fix-per-issue convention these shouldn't both merge. This is wallet/UTXO coin-selection code (consensus-adjacent), so it goes through the security-review pass before either lands rather than a quick merge. Flagging so the two PRs get reconciled — likely the earliest clean implementation merges and the other is credited/closed. Bug-report credit here stands regardless of which fix wins.

[rebel117]

I'd like to work on this. The fix will add a cap-aware fallback: after largest-first also exceeds 20 inputs, take only the top 20 largest UTXOs and check if they cover the target. If they do, return those (capped at 20). If not, return a clear insufficient-funds result. This handles unequal UTXOs correctly and gives a cleaner failure for the equal-value edge case. Will include a regression test.