@Fry - I like your thinking as the forger can't do anything to change that (other than not forge which results in the not allowed to forge for a while penalty), however, it still means that the forger at least knows this value and so might decide whether or not to include their own tx depending upon whether they win (effectively improving their odds vs. non-forgers).

@greatwolf - I am not sure of the exact reason for the malleability (perhaps it is due to the choice of a random value for the signature stuff?) but have been assured by CfB that this is the case. This type of malleability also exists in Bitcoin but it isn't the cause of the recent problems as only the private key holder can create a different but still valid signature by using a different random number (if you play with "signrawtransaction" you'll notice that each time you call it you end up with a result due to this behaviour).

@Zahlen - I had also started to think along those lines and it could work fairly for players other than in the "final" block. The problem in the final block is once again the forger can check whether or not their own tx will be a winner and if not simply omit it. In fact you could even end up with the lottery being stuck as each forger might refuse to run that script unless their own tx can be inserted as the winner.

Effectively you need the block that marks where the payout applies from to be one that has already been forged *but* not knowable until a subsequent block and also not even approximately knowable in order to prevent gaming the system.

And btw thanks for the input guys - as you can see we are dealing with some rather tricky problems.