When signing a transaction using the go-ethereum
library, the resulting object looks something like this:
"tx": {
"nonce": "0x7",
"gasPrice": "0x77359400",
"gas": "0x5208",
"to": "0x9ea773969b2622a0a361fd137b088f90f88bd82f",
"value": "0x7a120",
"input": "0x",
"v": "0x47a",
"r": "0x1944717416cde8sa47ed607325bfb85a40618da4a6dab9c6e1636609612deddd",
"s": "0x5480b689ffbab6o7dc58ae5d04369c3841a4fcbc95edecf7cf8608b9bf818e9c",
"hash": "0x997d39754493fee0581985667s89874a83c8d93b29e0e8802831781b140b87d2"
}
The way I understand the transaction verification process is that the Public key, the Hash of he transaction and the signature's r, s, v values are all used to verify that the transaction was indeed signed by the user's Private key.
What I can't seem to understand is why does the signed transaction object often include a "hash"
field e.g. https://web3js.readthedocs.io/en/1.0/web3-eth.html#signtransaction
i.e. my assumption would be that if you are veryfiying against the provided hash, then you're not really veryfying anything (the hash could be compromised). My understanding is that you always want to hash the transaction yourself in order to verify that this is indeed the correct hash which has been signed by the user's private key.
What am I missing?