What is preventing malicious miners stealing data to steal smart contract rewards?

Question

The motivation for this question is roughly along the lines of a puzzle contract -- whoever submits the correct solution to the puzzle gets a reward from the contract.

I'm guessing that the 'thing' in a transaction that is actually signed is a hash of the from: and to: addresses (the sender and recipient addresses of the transaction in question), and value too.. This would prevent malicious miners from just changing all to: addresses to ones owned by themselves, and mining blocks transferring random people's money to them.

Is the data field included in the hash too? Is it also sent in the clear? Is there anything 'binding' the signature/original sender and the data together? If not, is there anything else preventing puzzle solutions submitted to the contract being intercepted and resubmitted by the lucky guy mining the block?

Answer 1

All of the data in the transaction is signed and visible to everyone, including the miners.

A good way of preventing miners from stealing solutions is to have the person first submit the hash of the solution, then later submit the actual solution once the hash has already been mined.