I understand there are a couple things that need to be checked for a transaction to be valid - the previous transaction had to be correct, no OP can invalidate the transaction, etc, but is there a complete list on what one needs to check in order to know if a transaction is valid?
For example, does the transaction need to have a specific structure in order to be spent, like the script from TxIn needs to compile to the encoded message, and the TxOut script needs to properly run OP_Checksig on that particular message? If not, one could simply drop the message from TxIn, push their own malicious message and run OP_Checksig on that.
What steps does the protocol require a client to go through to check if the transaction is valid?