The transaction data to sign does not exclude public keys on scriptSig.

[Kangmo]

Source File: _includes/devdoc/guide_transactions.md

=> In essence, the entire transaction is signed except for any signature scripts, which hold the full public keys and secp256k1 signatures.

The full public keys in signature scripts are included for signature calculation. Here is the list of data excluded from the signature script.

1. signatures
2. OP_CODESEPARATOR

Also, with OP_CODESEPARATOR, the one who creates a transaction can control the data to be included for calculating the signature.

[wbnns]

Bounty: 5,000 bits / ~$10 USD

[Kangmo]

thank you wbnns for the bounty.
Here is my address. Is there any step that I need to follow?

1LHesg4yPM1ksyi8ZpstGWTtaQm9pcYT2X

[wbnns]

@Kangmo Hello, yes, first you need to submit a pull request that gets merged, resolving this issue.

[achow101]

@Kangmo that is incorrect. The pubkeys are not included in the data that is signed. It is part of the scriptsig so it is not included in the data. The scriptsig is actually replaced with the scriptPubKey, which is (a misnomer) actually the output script which the transaction is spending from.

[wbnns]

@achow101 Thanks for the review; closing. @Kangmo Please feel free to clarify if anything has been misunderstood and this is in fact a valid issue.