From jmduque on gitter (with small edits to help clarifying):
This is an issue with the implementation of the
get_spent()query for MongoDB.
For the RethinkDB implementation the issue does NOT arise.How to duplicate the bug?
- Create a divisible asset (outputs: tx1-0)
- Transfer 2 amount to user A and 2 amount to user B (input: tx1-0, outpus: tx2-0/tx2-1)
- Transfer another 1 Amount to A (inputs: tx1-0, ouputs: tx3-0/tx3-1)
- Transfer 3 Amount from user A to user B (inputs: tx2-1/tx3-0, outputs: tx4-0/tx4-1)
- Transfer 2 Amount from user B to user A (inputs: tx2-0, outputs: tx5-0)
See report by jmduque on gitter: https://gitter.im/bigchaindb/bigchaindb?at=58c12bf200c00c3d4fe02c88 for all details.
/cc @jmduque
The bug arises when you ask for all of A's unspent outputs. The answer should be tx5-0 (i.e. only one unspent output), but the response is an error about invalid blockchain because of double-spend of output tx2-0.
I drew a little diagram to understand how all the transactions are related:

@jmduque a test that attempts to reproduce the issue is at https://github.com/sbellem/bigchaindb/blob/bug-1271-false-double-spend/tests/test_core.py#L331
It must be noted that the test should fail but does not right now. There are two possibilities: