Program: 35113
Project: 35113
Buggy source:
@Override public ValidateResult validate(AbstractCoinTransaction tx){
  if (tx.isSkipInputValidator()) {
    return ValidateResult.getSuccessResult();
  }
  UtxoData data=(UtxoData)tx.getCoinData();
  for (int i=0; i < data.getInputs().size(); i++) {
    UtxoInput input=data.getInputs().get(i);
    UtxoOutput output=ledgerCacheService.getUtxo(input.getKey());
    if (output == null && tx.getStatus() == TxStatusEnum.UNCONFIRM) {
      return ValidateResult.getFailedResult(ErrorCode.ORPHAN_TX);
    }
 else     if (output == null) {
      return ValidateResult.getFailedResult(ErrorCode.UTXO_NOT_FOUND);
    }
    long blockHeight=tx.getBlockHeight();
    if (blockHeight < 0) {
      blockHeight=NulsContext.getInstance().getBestHeight();
    }
    if (tx.getStatus() == TxStatusEnum.UNCONFIRM) {
      if (tx.getType() == TransactionConstant.TX_TYPE_STOP_AGENT) {
        if (output.getStatus() != OutPutStatusEnum.UTXO_CONSENSUS_LOCK) {
          return ValidateResult.getFailedResult(ErrorCode.UTXO_STATUS_CHANGE);
        }
      }
 else       if (!output.isUsable(blockHeight)) {
        return ValidateResult.getFailedResult(ErrorCode.UTXO_STATUS_CHANGE);
      }
    }
    byte[] owner=output.getOwner();
    P2PKHScriptSig p2PKHScriptSig=null;
    try {
      p2PKHScriptSig=P2PKHScriptSig.createFromBytes(tx.getScriptSig());
    }
 catch (    NulsException e) {
      return ValidateResult.getFailedResult(ErrorCode.DATA_ERROR);
    }
    byte[] user=p2PKHScriptSig.getSignerHash160();
    if (!Arrays.equals(owner,user)) {
      return ValidateResult.getFailedResult(ErrorCode.INVALID_INPUT);
    }
    return ValidateResult.getSuccessResult();
  }
  return ValidateResult.getSuccessResult();
}

Fixed version (ground truth):
@Override public ValidateResult validate(AbstractCoinTransaction tx){
  if (tx.isSkipInputValidator()) {
    return ValidateResult.getSuccessResult();
  }
  UtxoData data=(UtxoData)tx.getCoinData();
  for (int i=0; i < data.getInputs().size(); i++) {
    UtxoInput input=data.getInputs().get(i);
    UtxoOutput output=ledgerCacheService.getUtxo(input.getKey());
    if (output == null && tx.getStatus() == TxStatusEnum.UNCONFIRM) {
      return ValidateResult.getFailedResult(ErrorCode.ORPHAN_TX);
    }
 else     if (output == null) {
      return ValidateResult.getFailedResult(ErrorCode.UTXO_NOT_FOUND);
    }
    long blockHeight=tx.getBlockHeight();
    if (blockHeight < 0) {
      blockHeight=NulsContext.getInstance().getBestHeight();
    }
    if (tx.getStatus() == TxStatusEnum.UNCONFIRM) {
      if (tx.getType() == TransactionConstant.TX_TYPE_STOP_AGENT) {
        if (output.getStatus() != OutPutStatusEnum.UTXO_CONSENSUS_LOCK) {
          return ValidateResult.getFailedResult(ErrorCode.UTXO_STATUS_CHANGE);
        }
      }
 else       if (!output.isUsable(blockHeight)) {
        return ValidateResult.getFailedResult(ErrorCode.UTXO_STATUS_CHANGE);
      }
    }
    byte[] owner=output.getOwner();
    P2PKHScriptSig p2PKHScriptSig=null;
    try {
      p2PKHScriptSig=P2PKHScriptSig.createFromBytes(tx.getScriptSig());
    }
 catch (    NulsException e) {
      return ValidateResult.getFailedResult(ErrorCode.DATA_ERROR);
    }
    byte[] user=p2PKHScriptSig.getSignerHash160();
    if (!Arrays.equals(owner,user)) {
      return ValidateResult.getFailedResult(ErrorCode.INVALID_INPUT);
    }
  }
  return ValidateResult.getSuccessResult();
}