The motivation for this question is roughly along the lines of a puzzle contract -- whoever submits the correct solution to the puzzle gets a reward from the contract.
I'm guessing that the 'thing' in a transaction that is actually signed is a hash of the from:
and to:
addresses (the sender and recipient addresses of the transaction in question), and value
too.. This would prevent malicious miners from just changing all to:
addresses to ones owned by themselves, and mining blocks transferring random people's money to them.
Is the data
field included in the hash too? Is it also sent in the clear? Is there anything 'binding' the signature/original sender and the data together? If not, is there anything else preventing puzzle solutions submitted to the contract being intercepted and resubmitted by the lucky guy mining the block?