Duplicate operation in transaction?

Question

I'm having trouble understanding the operations of this transaction: https://horizon.stellar.org/transactions/f06c6a478b0caac5c8b33512100f70c1aa192bee3af7084f2b693df7f75689bd/operations

It seems the amount 20.0098520 was moved twice with an account merge, once in operation 16530607567802369 and once in 16530607567802370.

Looking at the affected source account, it seems it was debited and removed twice, with one account_debited effect immediately following an account_removed effect: https://horizon.stellar.org/accounts/GBSSDVJTXF6XJUN5EWCUXDMCGYGNCIDTPL6G6WM6FTG3G4GDGDKU7Z2T/effects

Lastly, summing up the effects of all account_created, account_debited and account_credited results in a negative balance:

-20.0098120 = 20.9998920 + 15.0000000 - 15.9900000 - 20.0098520 - 20.0098520

I'm not sure what I'm missing here, did either of the merges fail? Why are there two merges and how can I build similar transactions?

Answer 1

Turns out I rediscovered the infamous Stellar inflation bug: https://github.com/stellar/stellar-core/blob/master/docs/software/security-protocol-release-notes.md#v061c-not-widely-released---2017-04-08

Ledger - security - merge account could be called on an account already merged in the same ledger, causing the Lumens balance of the doubly merged account to be credited multiple times into the destination account

exploited: yes rogue transactions caused new Lumens to be created, not accounted for in total coins