fix: stop importing unscreened third-party UTXOs into the ckBTC minter reserve

[gregorydemay]

Purpose

The ckBTC minter screens normal deposits (minimum amount, check fee, and the Bitcoin checker / KYT) before any UTXO enters the spendable reserve. The withdrawal finalization path did not: it fetched every UTXO at the minter's main Bitcoin address and imported all of them into available_utxos, filtering only on whether a UTXO was already known.

Because the minter's main address is publicly derivable, anyone could send BTC directly to it. Those unscreened UTXOs entered the reserve and became eligible to be co-spent in minter-signed withdrawal transactions, and they inflated the minter's internal tokens_minted counter without any corresponding mint.

This restricts finalization to import only UTXOs that match a change output of a transaction the minter itself submitted. Any other UTXO at the main address is dropped rather than absorbed into the reserve.

Changes

• Add a failing test reproducing a third-party UTXO at the main address entering available_utxos during finalization.
• Filter the UTXOs imported during finalization down to those matching a known change output of a submitted or stuck transaction.

Notes

The two commits are ordered failing-test-first, then fix. The heavy integration target //rs/bitcoin/ckbtc/minter:ckbtc_minter_tests could not be built in the authoring environment (missing autoconf for jemalloc); the minter unit tests and replay-event tests all pass.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens the ckBTC minter’s withdrawal-finalization path so that UTXOs at the publicly-derivable main minter address are only imported into the spendable reserve if they correspond to a known change output from a minter-submitted (or stuck) transaction, preventing unscreened third-party deposits from entering available_utxos and affecting accounting.

Changes:

• Added a regression test covering third-party UTXOs at the main address being incorrectly imported during finalization.
• Introduced filtering to retain only change-output UTXOs from the minter’s submitted/stuck transactions before calling state::audit::add_utxos.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
rs/bitcoin/ckbtc/minter/src/tests.rs	Adds a unit test ensuring third-party UTXOs at the main address are not imported during finalization.
rs/bitcoin/ckbtc/minter/src/lib.rs	Filters finalization-imported UTXOs to only those matching known change outputs of submitted/stuck transactions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.