Program: 35193
Project: 35193
Buggy source:
@Override public CoinData createByTransferData(Transaction tx,CoinTransferData coinParam,String password) throws NulsException {
  UtxoData utxoData=new UtxoData();
  List<UtxoInput> inputs=new ArrayList<>();
  List<UtxoOutput> outputs=new ArrayList<>();
  if (coinParam.getTotalNa().equals(Na.ZERO)) {
    utxoData.setInputs(inputs);
    utxoData.setOutputs(outputs);
    return utxoData;
  }
  long inputValue=0;
  if (!coinParam.getFrom().isEmpty()) {
    List<UtxoOutput> unSpends=coinManager.getAccountsUnSpend(coinParam.getFrom(),coinParam.getTotalNa().add(coinParam.getFee()));
    for (int i=0; i < unSpends.size(); i++) {
      UtxoOutput output=unSpends.get(i);
      UtxoInput input=new UtxoInput();
      input.setFrom(output);
      inputs.add(input);
      input.setParent(tx);
      input.setIndex(i);
      inputValue+=output.getValue();
    }
  }
  byte[] priKey=null;
  if (coinParam.getPriKey() != null) {
    priKey=coinParam.getPriKey();
  }
 else {
    Account account=accountService.getDefaultAccount();
    priKey=account.getPriSeed();
  }
  int i=0;
  long outputValue=0;
  for (  Map.Entry<String,Coin> entry : coinParam.getToMap().entrySet()) {
    UtxoOutput output=new UtxoOutput();
    String address=entry.getKey();
    Coin coin=entry.getValue();
    output.setAddress(new Address(address).getHash());
    output.setValue(coin.getNa().getValue());
    output.setStatus(UtxoOutput.USEABLE);
    output.setIndex(i);
    output.setScript(ScriptBuilder.createOutputScript(ECKey.fromPrivate(new BigInteger(priKey))));
    output.setScriptBytes(output.getScript().getProgram());
    if (coin.getUnlockHeight() > 0) {
      output.setLockTime(coin.getUnlockHeight());
    }
 else     if (coin.getUnlockTime() > 0) {
      output.setLockTime(coin.getUnlockTime());
    }
 else {
      output.setLockTime(0L);
    }
    output.setParent(tx);
    outputValue+=output.getValue();
    outputs.add(output);
    i++;
  }
  long balance=inputValue - outputValue - coinParam.getFee().getValue();
  if (balance > 0) {
    UtxoOutput output=new UtxoOutput();
    output.setAddress(inputs.get(0).getFrom().getAddress());
    output.setValue(balance);
    output.setIndex(i);
    output.setParent(tx);
    output.setStatus(UtxoOutput.USEABLE);
    output.setScript(ScriptBuilder.createOutputScript(new ECKey()));
    output.setScriptBytes(output.getScript().getProgram());
    outputs.add(output);
  }
  utxoData.setInputs(inputs);
  utxoData.setOutputs(outputs);
  return utxoData;
}

Fixed version (ground truth):
@Override public CoinData createByTransferData(Transaction tx,CoinTransferData coinParam,String password) throws NulsException {
  UtxoData utxoData=new UtxoData();
  List<UtxoInput> inputs=new ArrayList<>();
  List<UtxoOutput> outputs=new ArrayList<>();
  if (coinParam.getTotalNa().equals(Na.ZERO)) {
    utxoData.setInputs(inputs);
    utxoData.setOutputs(outputs);
    return utxoData;
  }
  long inputValue=0;
  if (!coinParam.getFrom().isEmpty()) {
    List<UtxoOutput> unSpends=coinManager.getAccountsUnSpend(coinParam.getFrom(),coinParam.getTotalNa().add(coinParam.getFee()));
    for (int i=0; i < unSpends.size(); i++) {
      UtxoOutput output=unSpends.get(i);
      UtxoInput input=new UtxoInput();
      input.setFrom(output);
      inputs.add(input);
      input.setParent(tx);
      input.setIndex(i);
      inputValue+=output.getValue();
    }
  }
  byte[] priKey=null;
  if (coinParam.getPriKey() != null) {
    priKey=coinParam.getPriKey();
  }
 else {
    Account account=accountService.getDefaultAccount();
    priKey=account.getPriSeed();
  }
  int i=0;
  long outputValue=0;
  for (  Map.Entry<String,List<Coin>> entry : coinParam.getToMap().entrySet()) {
    String address=entry.getKey();
    List<Coin> coinList=entry.getValue();
    for (    Coin coin : coinList) {
      UtxoOutput output=new UtxoOutput();
      output.setAddress(new Address(address).getHash());
      output.setValue(coin.getNa().getValue());
      output.setStatus(UtxoOutput.USEABLE);
      output.setIndex(i);
      output.setScript(ScriptBuilder.createOutputScript(ECKey.fromPrivate(new BigInteger(priKey))));
      output.setScriptBytes(output.getScript().getProgram());
      if (coin.getUnlockHeight() > 0) {
        output.setLockTime(coin.getUnlockHeight());
      }
 else       if (coin.getUnlockTime() > 0) {
        output.setLockTime(coin.getUnlockTime());
      }
 else {
        output.setLockTime(0L);
      }
      output.setParent(tx);
      outputValue+=output.getValue();
      outputs.add(output);
      i++;
    }
  }
  long balance=inputValue - outputValue - coinParam.getFee().getValue();
  if (balance > 0) {
    UtxoOutput output=new UtxoOutput();
    output.setAddress(inputs.get(0).getFrom().getAddress());
    output.setValue(balance);
    output.setIndex(i);
    output.setParent(tx);
    output.setStatus(UtxoOutput.USEABLE);
    output.setScript(ScriptBuilder.createOutputScript(new ECKey()));
    output.setScriptBytes(output.getScript().getProgram());
    outputs.add(output);
  }
  utxoData.setInputs(inputs);
  utxoData.setOutputs(outputs);
  return utxoData;
}