Summary

Replace the unsafe usize→u32 narrowing cast in utxos_info_from_output with a checked u32::try_from() conversion to eliminate silent truncation and potential UTXO index corruption.

🎫 Ticket 📐 Engineering

Motivation

The Least Authority audit (October 2025, Issue AA) identified an unchecked as u32 cast in utxos_info_from_output (ledger/src/versions/common/api/transaction.rs). On 64-bit platforms, if output_no exceeds u32::MAX, the value is silently truncated via wrapping, producing an incorrect UTXO output index. While the practical likelihood is low (a transaction with >4B outputs is not expected), the defect violates correctness invariants and was flagged as High severity.

Changes

• Cast replacement — output_no as u32 → u32::try_from(output_no)? in utxos_info_from_output
• Signature change — Return type: Vec<UtxoInfo> → Result<Vec<UtxoInfo>, TryFromIntError>
• Call-site updates — Two call sites in unshielded_utxos handle the Result with log::error! + return UnshieldedUtxos::default()
• Unit tests — Four new tests: empty vec, single output, sequential indices, field propagation

Testing

• cargo check -p midnight-node-ledger — passes
• cargo clippy -p midnight-node-ledger --lib -- -D warnings — passes, no warnings
• cargo fmt -- --check — passes
• cargo test — blocked by pre-existing hard_fork_test compilation error (extract_info_from_tx_with_context import); unrelated to this change

📌 Submission Checklist

• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason: audit fix, no user-facing change file needed
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• No new todos introduced

🔱 Fork Strategy

• Node Runtime Update
• Node Client Update
• Other
• N/A