Decoy selection that leaks the real output on monero-oxide
##The intent
monero-oxide (a Rust implementation of Monero primitives) builds the ring a transaction spends against by querying candidate outputs in batches. The real output is supposed to be folded into the first query so an observer can't tell it apart.
##The off-by-one
The first-iteration guard is keyed on iters == 0, but iters is incremented before the check. So the real output is never mixed into the first get_unlocked_outputs batch.
An on-path node then computes the set difference between the on-chain ring and that first candidate set — the element that's in the ring but not in the first batch is the true spend. The effective anonymity set collapses to 1, defeating the core privacy guarantee.
##Why it matters
Privacy bugs don't announce themselves as lost funds — they're the quiet failure of the thing users are paying for. A single mis-ordered increment is enough to unmask a spend.