Program: 35175
Project: 35175
Buggy source:
@Override public CoinData createByTransferData(Transaction tx,CoinTransferData coinParam,String password) throws NulsException {
  UtxoData utxoData=new UtxoData();
  List<UtxoInput> inputs=new ArrayList<>();
  List<UtxoOutput> outputs=new ArrayList<>();
  if (coinParam.getTotalNa().equals(Na.ZERO)) {
    utxoData.setInputs(inputs);
    utxoData.setOutputs(outputs);
    return utxoData;
  }
  long inputValue=0;
  if (!coinParam.getFrom().isEmpty()) {
    List<UtxoOutput> unSpends=coinManager.getAccountsUnSpend(coinParam.getFrom(),coinParam.getTotalNa().add(coinParam.getFee()));
    if (unSpends.isEmpty()) {
      throw new NulsException(ErrorCode.BALANCE_NOT_ENOUGH);
    }
    for (int i=0; i < unSpends.size(); i++) {
      UtxoOutput output=unSpends.get(i);
      UtxoInput input=new UtxoInput();
      input.setFrom(output);
      input.setFromHash(output.getTxHash());
      input.setFromIndex(output.getIndex());
      input.setParent(tx);
      input.setIndex(i);
      inputValue+=output.getValue();
      inputs.add(input);
    }
  }
  Account account=null;
  byte[] priKey=null;
  if (coinParam.getPriKey() != null) {
    priKey=coinParam.getPriKey();
  }
 else   if (!coinParam.getFrom().isEmpty()) {
    account=accountService.getAccount(coinParam.getFrom().get(0));
    if (account == null) {
      throw new NulsException(ErrorCode.ACCOUNT_NOT_EXIST);
    }
    if (account.isEncrypted() && account.isLocked()) {
      if (!account.unlock(password)) {
        throw new NulsException(ErrorCode.PASSWORD_IS_WRONG);
      }
      priKey=account.getPriKey();
      account.lock();
    }
 else {
      priKey=account.getPriKey();
    }
  }
  int i=0;
  long outputValue=0;
  for (  Map.Entry<String,List<Coin>> entry : coinParam.getToMap().entrySet()) {
    String address=entry.getKey();
    List<Coin> coinList=entry.getValue();
    for (    Coin coin : coinList) {
      UtxoOutput output=new UtxoOutput();
      output.setAddress(address);
      output.setValue(coin.getNa().getValue());
      output.setStatus(UtxoOutput.UTXO_CONFIRM_UNLOCK);
      output.setIndex(i);
      P2PKHScript p2PKHScript=new P2PKHScript(new NulsDigestData(NulsDigestData.DIGEST_ALG_SHA160,new Address(address).getHash160()));
      output.setScript(p2PKHScript);
      if (coin.getUnlockHeight() > 0) {
        output.setLockTime(coin.getUnlockHeight());
      }
 else       if (coin.getUnlockTime() > 0) {
        output.setLockTime(coin.getUnlockTime());
      }
 else {
        output.setLockTime(0L);
      }
      output.setParent(tx);
      outputValue+=output.getValue();
      outputs.add(output);
      i++;
    }
  }
  long balance=inputValue - outputValue - coinParam.getFee().getValue();
  if (balance > 0) {
    UtxoOutput output=new UtxoOutput();
    output.setAddress(inputs.get(0).getFrom().getAddress());
    output.setValue(balance);
    output.setIndex(i);
    output.setParent(tx);
    output.setStatus(UtxoOutput.UTXO_CONFIRM_UNLOCK);
    P2PKHScript p2PKHScript=new P2PKHScript(new NulsDigestData(NulsDigestData.DIGEST_ALG_SHA160,account.getHash160()));
    output.setScript(p2PKHScript);
    outputs.add(output);
  }
  utxoData.setInputs(inputs);
  utxoData.setOutputs(outputs);
  return utxoData;
}

Fixed version (ground truth):
@Override public CoinData createByTransferData(Transaction tx,CoinTransferData coinParam,String password) throws NulsException {
  UtxoData utxoData=new UtxoData();
  List<UtxoInput> inputs=new ArrayList<>();
  List<UtxoOutput> outputs=new ArrayList<>();
  if (coinParam.getTotalNa().equals(Na.ZERO)) {
    utxoData.setInputs(inputs);
    utxoData.setOutputs(outputs);
    return utxoData;
  }
  long inputValue=0;
  if (!coinParam.getFrom().isEmpty()) {
    List<UtxoOutput> unSpends=coinManager.getAccountsUnSpend(coinParam.getFrom(),coinParam.getTotalNa().add(coinParam.getFee()));
    if (unSpends.isEmpty()) {
      throw new NulsException(ErrorCode.BALANCE_NOT_ENOUGH);
    }
    for (int i=0; i < unSpends.size(); i++) {
      UtxoOutput output=unSpends.get(i);
      UtxoInput input=new UtxoInput();
      input.setFrom(output);
      input.setFromHash(output.getTxHash());
      input.setFromIndex(output.getIndex());
      input.setParent(tx);
      input.setIndex(i);
      inputValue+=output.getValue();
      inputs.add(input);
    }
  }
  Account account=null;
  byte[] priKey=null;
  if (coinParam.getPriKey() != null) {
    priKey=coinParam.getPriKey();
  }
 else   if (!coinParam.getFrom().isEmpty()) {
    account=accountService.getAccount(coinParam.getFrom().get(0));
    if (account == null) {
      throw new NulsException(ErrorCode.ACCOUNT_NOT_EXIST);
    }
    if (account.isEncrypted() && account.isLocked()) {
      if (!account.unlock(password)) {
        throw new NulsException(ErrorCode.PASSWORD_IS_WRONG);
      }
      priKey=account.getPriKey();
      account.lock();
    }
 else {
      priKey=account.getPriKey();
    }
  }
  int i=0;
  long outputValue=0;
  for (  Map.Entry<String,List<Coin>> entry : coinParam.getToMap().entrySet()) {
    String address=entry.getKey();
    List<Coin> coinList=entry.getValue();
    for (    Coin coin : coinList) {
      UtxoOutput output=new UtxoOutput();
      output.setAddress(address);
      output.setValue(coin.getNa().getValue());
      output.setStatus(UtxoOutput.UTXO_CONFIRM_UNLOCK);
      output.setIndex(i);
      P2PKHScript p2PKHScript=new P2PKHScript(new NulsDigestData(NulsDigestData.DIGEST_ALG_SHA160,new Address(address).getHash160()));
      output.setP2PKHScript(p2PKHScript);
      if (coin.getUnlockHeight() > 0) {
        output.setLockTime(coin.getUnlockHeight());
      }
 else       if (coin.getUnlockTime() > 0) {
        output.setLockTime(coin.getUnlockTime());
      }
 else {
        output.setLockTime(0L);
      }
      output.setParent(tx);
      outputValue+=output.getValue();
      outputs.add(output);
      i++;
    }
  }
  long balance=inputValue - outputValue - coinParam.getFee().getValue();
  if (balance > 0) {
    UtxoOutput output=new UtxoOutput();
    output.setAddress(inputs.get(0).getFrom().getAddress());
    output.setValue(balance);
    output.setIndex(i);
    output.setParent(tx);
    output.setStatus(UtxoOutput.UTXO_CONFIRM_UNLOCK);
    P2PKHScript p2PKHScript=new P2PKHScript(new NulsDigestData(NulsDigestData.DIGEST_ALG_SHA160,account.getHash160()));
    output.setP2PKHScript(p2PKHScript);
    outputs.add(output);
  }
  utxoData.setInputs(inputs);
  utxoData.setOutputs(outputs);
  return utxoData;
}