fix(token): check global symbol uniqueness in finishCreate to prevent duplicate mint

[33cn]

Vulnerability

Duplicate finishCreate of the same token symbol causes over-issuance (N x Total minted).

• Location: plugin/dapp/token/executor/tokendb.go finishCreate (~line 242)

Root cause

finishCreate only looked up the per-owner record keyed by (symbol, owner) and checked its status. Unlike preCreate, which rejects a symbol whose global record mavl-token-<symbol> already exists (checkTokenExist, tokendb.go:182), finishCreate had no global symbol uniqueness check.

As a result, the same symbol could be precreated by N different owners (per-owner records, first-finisher-wins flow), and every owner could then be finished: each finishCreate ran GenesisInit(owner, Total), so a token declaring Total supply was actually issued N x Total.

Fix

In finishCreate, after the per-owner precreated-status check, add a global uniqueness check: if the global record mavl-token-<symbol> already exists (written by the first successful finish), reject with ErrTokenExist.

preCreate is intentionally left per-owner:

• preCreate-after-finish is already blocked globally by checkTokenExist (tokendb.go:182).
• Multiple owners precreating the same symbol before any finish is a valid existing usage (per-owner records); the first approved finish now wins and any later duplicate finish is rejected. Changing preCreate to global dedup would break this flow and is not needed to close the over-issuance.

Fork gating

The behavior change is gated by a new dapp fork ForkTokenFinishCheck (token/types, registered at height 0, following the ForkEVMFixOverflow pattern). Before the fork height the old behavior is preserved to avoid breaking consensus of running chains. Config lines are added under [fork.sub.token] in chain33.fork.toml, chain33.para.toml, plugin/dapp/evm/cmd/ci2/chain33.proxyminer.toml and plugin/dapp/ticket/executor/testdata/chain33.cfg.toml.

Tests

New file plugin/dapp/token/executor/token_finishcheck_test.go (helpers uniquely prefixed with dupFinish to avoid redefinition when merging with other PRs):

• TestTokenDupFinishCreateRejected: with the fork active, two owners precreate the same symbol; the first finish succeeds; the duplicate finish is rejected with ErrTokenExist; repeated same-owner finish still fails with ErrTokenNotPrecreated; only the first owner holds Total, no over-issuance.
• TestTokenDupFinishCreatePreFork: below the fork height the old behavior is unchanged (duplicate finish succeeds).
• Normal precreate/finish flow is unaffected (also covered by existing TestToken/TestFinish).

go test -ldflags=-checklinkname=0 -count=1 ./plugin/dapp/token/... all pass; ./plugin/dapp/ticket/... (testdata toml touched) all pass.