In a transaction
Tx, the hash pointer of the earlier transaction (say
TxE) that serves as input to
Tx must be signed by the sender
Tx. This is to show that
S was the recipient of
It remains to show that
S agrees with the output of
Tx. At which stage does
S sign the output of
I assume (s)he does so. Else, what would prevent an attacker from looking at
Tx just after
S broadcasted it, and modify the output (so that he is the recipient) before rebroadcast?
In other words: The scriptSig proves the sender owns the input of Tx. What proves that the sender approves the output of the Tx?
P.S: the transaction I am considering atm is: