<p>The signing of the transaction is done over the entire content of the transaction. Any subsequent changes to the transaction would invalidate that signature and thus the entire transaction.</p>
<p>It should be noted that there are certain cases when the signature is not performed on the entire content of the transaction (a SIGHASH other than SIGHASH_ALL is used). However, these are some specific use cases.</p>

CC BY-SA 4.0
2023-09-18T15:53:59.353Z
I wrote a post on my blog explaining SIGHASH:
https://joaobordalo.com/articles/2023/07/13/explaining_sighash.html
bordalix
CC BY-SA 4.0
2023-09-18T16:05:07.050Z
I undestand that. But you could change the signature also and sign it with YOUR key. Since public key is retrieved from one of the inputs (and one of them has my public key), it can be the input with my public key, so the signture will be valid.
Denys Malovanyi
CC BY-SA 4.0
2023-09-18T16:13:13.383Z
@DenysMalovanyi You can't change someone's signature because you don't have the corresponding private key. You can't add another additional input with your signature because you will invalidate signature in original input. You can't replace the original signature with your signature because your signature will not unlock the coins.
dassd
CC BY-SA 4.0
2023-09-18T16:21:55.040Z
@Filip, I agree, I don't have a private key for the first UTXO, but I can just copy the input that spends this UTXO from another transaction along with the signature which unlocks it. As I know transactions are broadcasted to the network when created. If someone will be fast and lucky enough to catch this transaction early, copy-paste its input and add their own one, then broadcast the new transaction so that miners will receive it before the original reaches them, one could potentially steal the money.
Denys Malovanyi
CC BY-SA 4.0
2023-09-18T16:23:56.110Z
@DenysMalovanyi If you add an extra input, the transaction changes, and thus the message being signed changes, and thus the original signature for the original input will not be valid anymore. You seem to be under the assumption that the original's signature only applies to the original input - this is not correct, it applies to the entire transaction, and that changes when you add an input.
Pieter Wuille
CC BY-SA 4.0
2023-09-18T16:27:03.367Z
@PieterWuille, yes, that clears things up for me, thank you all for the replies.
Denys Malovanyi
CC BY-SA 4.0
2023-09-18T14:41:44.700Z
2023-09-18T14:48:07.133Z
2023-09-18T14:48:07.133Z
dassd
<p>There are <a href="https://raghavsood.com/blog/2018/06/10/bitcoin-signature-types-sighash" rel="nofollow noreferrer">different SIGHASH flags</a> which indicate what parts of the transaction  are signed. In the case of <code>SIGHASH_ALL</code> every input and output is part of the message that is being signed and so you wouldn't be able to change an input or an output of a transaction without going back to the owner of the private key who signed it in the first place to request another signature.</p>

CC BY-SA 4.0
2023-09-18T16:05:13.300Z
I undestand that. But you could change the signature also and sign it with YOUR key. Since public key is retrieved from one of the inputs (and one of them has my public key), it can be the input with my public key, so the signture will be valid.
Denys Malovanyi
CC BY-SA 4.0
2023-09-18T16:12:07.783Z
@DenysMalovanyi: To unlock a UTXO it requires a signature for a specific public key. You can try adding an additional UTXO that requires a signature from a public key that you own the private key for. But you won't have the private key to provide a signature to unlock the first UTXO, just the second. Hence you won't be able to spend the first UTXO.
Michael Folkson
CC BY-SA 4.0
2023-09-18T16:18:27.903Z
I agree, I don't have a private key for the first UTXO, but I can just copy the input that spends this UTXO from another transaction along with the signature which unlocks it. As I know transactions are broadcasted to the network when created. If someone will be fast and lucky enough to catch this transaction early, copy-paste its input and add their own one, then broadcast the new transaction so that miners will receive it before the original reaches them, one could potentially steal the money.
Denys Malovanyi
CC BY-SA 4.0
2023-09-18T14:51:14.323Z
2023-09-18T14:51:14.323Z
Michael Folkson
<p>In Bitcoin you can have different UTXO with different public keys in a single transaction.</p>
<p>So suppose someone broadcasts a transaction with sending 10000 BTC. Theoretically I can copy this transaction, add my input with 0.1 BTC and change output to my address. Then sign a transaction and rebroadcast it.</p>
<p>Some miner will receive it, and get transaction with two inputs: from initial sender (10000 BTC unlocked by him) and mine (0.1 BTC unlocked with my public key); and 1 output to my address. The whole transaction is signed with my private key. Public key for verifying the signature is extracted from one of the inputs. So my public key from the second input can be used for this purpose and the transaction will be valid. The source of 10000 BTC is unlocked with owner's private key, so I'll just steal the money.</p>
<p>Suppose my transaction has bigger fee and propagates across the network faster then original.</p>
<p>Is this threat real or not? If not then why? If yes then why isn't it eliminated trough restricting transaction inputs so all of them have the same public key?</p>
<p>EDIT:
What I mean is use a transaction with 2 inputs: one is used as an actual source of coins and is unlocked with a valid signature (because it is copied from the transaction of the one who owns the money) and another one is used as public key provider (it can be 0.00001 BTC, but must be unlocked with my public key so that is can be retrieved during whole transaction signature verifying and the whole transaction would be valid).</p>

CC BY-SA 4.0
2023-09-19T15:59:34.663Z
Possible duplicate of: https://bitcoin.stackexchange.com/questions/95564/why-is-there-no-such-thing-as-a-redirected-forged-or-fake-transaction
Murch
<transactions><signature><doublespend><sighash><sighash-flags>
Strange double-spending attack possibility
Denys Malovanyi
# Strange double-spending attack possibility

(Asked by: username_0 on 2023-09-18)

In Bitcoin you can have different UTXO with different public keys in a single transaction.

So suppose someone broadcasts a transaction with sending 10000 BTC. Theoretically I can copy this transaction, add my input with 0.1 BTC and change output to my address. Then sign a transaction and rebroadcast it.

Some miner will receive it, and get transaction with two inputs: from initial sender (10000 BTC unlocked by him) and mine (0.1 BTC unlocked with my public key); and 1 output to my address. The whole transaction is signed with my private key. Public key for verifying the signature is extracted from one of the inputs. So my public key from the second input can be used for this purpose and the transaction will be valid. The source of 10000 BTC is unlocked with owner's private key, so I'll just steal the money.

Suppose my transaction has bigger fee and propagates across the network faster then original.

Is this threat real or not? If not then why? If yes then why isn't it eliminated trough restricting transaction inputs so all of them have the same public key?

EDIT:
What I mean is use a transaction with 2 inputs: one is used as an actual source of coins and is unlocked with a valid signature (because it is copied from the transaction of the one who owns the money) and another one is used as public key provider (it can be 0.00001 BTC, but must be unlocked with my public key so that is can be retrieved during whole transaction signature verifying and the whole transaction would be valid).

**Tags:** transactions, signature, doublespend, sighash, sighash-flags

> **Comments:**
> **username_1**: Possible duplicate of: https://bitcoin.stackexchange.com/questions/95564/why-is-there-no-such-thing-as-a-redirected-forged-or-fake-transaction  

---

## 2 answers

### Answer by username_2 on 2023-09-18. Score: 2 | Accepted answer

The signing of the transaction is done over the entire content of the transaction. Any subsequent changes to the transaction would invalidate that signature and thus the entire transaction.

It should be noted that there are certain cases when the signature is not performed on the entire content of the transaction (a SIGHASH other than SIGHASH\_ALL is used). However, these are some specific use cases.

> **Comments:**
> **username_3**: I wrote a post on my blog explaining SIGHASH: https://joaobordalo.com/articles/2023/07/13/explaining_sighash.html  
> **username_0**: I undestand that. But you could change the signature also and sign it with YOUR key. Since public key is retrieved from one of the inputs (and one of them has my public key), it can be the input with my public key, so the signture will be valid.  
> **username_2**: @username_0 You can't change someone's signature because you don't have the corresponding private key. You can't add another additional input with your signature because you will invalidate signature in original input. You can't replace the original signature with your signature because your signature will not unlock the coins.  
> **username_0**: @Filip, I agree, I don't have a private key for the first UTXO, but I can just copy the input that spends this UTXO from another transaction along with the signature which unlocks it. As I know transactions are broadcasted to the network when created. If someone will be fast and lucky enough to catch this transaction early, copy-paste its input and add their own one, then broadcast the new transaction so that miners will receive it before the original reaches them, one could potentially steal the money.  
> **username_4**: @username_0 If you add an extra input, the transaction changes, and thus the message being signed changes, and thus the original signature for the original input will not be valid anymore. You seem to be under the assumption that the original's signature only applies to the original input - this is not correct, it applies to the entire transaction, and that changes when you add an input.  
> **username_0**: @username_4, yes, that clears things up for me, thank you all for the replies.  

---

### Answer by username_5 on 2023-09-18. Score: 0

There are [different SIGHASH flags](https://raghavsood.com/blog/2018/06/10/bitcoin-signature-types-sighash) which indicate what parts of the transaction are signed. In the case of `SIGHASH_ALL` every input and output is part of the message that is being signed and so you wouldn't be able to change an input or an output of a transaction without going back to the owner of the private key who signed it in the first place to request another signature.

> **Comments:**
> **username_0**: I undestand that. But you could change the signature also and sign it with YOUR key. Since public key is retrieved from one of the inputs (and one of them has my public key), it can be the input with my public key, so the signture will be valid.  
> **username_5**: @username_0: To unlock a UTXO it requires a signature for a specific public key. You can try adding an additional UTXO that requires a signature from a public key that you own the private key for. But you won't have the private key to provide a signature to unlock the first UTXO, just the second. Hence you won't be able to spend the first UTXO.  
> **username_0**: I agree, I don't have a private key for the first UTXO, but I can just copy the input that spends this UTXO from another transaction along with the signature which unlocks it. As I know transactions are broadcasted to the network when created. If someone will be fast and lucky enough to catch this transaction early, copy-paste its input and add their own one, then broadcast the new transaction so that miners will receive it before the original reaches them, one could potentially steal the money.  

---

