ctfwriteup.com
Search…
⌃K

Puzzle 1

CALLVALUE, JUMP, JUMPDEST

Puzzle

############
# Puzzle 1 #
############
00 34 CALLVALUE
01 56 JUMP
02 FD REVERT
03 FD REVERT
04 FD REVERT
05 FD REVERT
06 FD REVERT
07 FD REVERT
08 5B JUMPDEST
09 00 STOP
? Enter the value to send: (0)

Solution

Look up CALLVALUE on evm.codes:
Get deposited value by the instruction/transaction responsible for this execution
In other words, CALLVALUE pushes msg.value onto the stack. In this puzzle, our input is used as msg.value.
After that, JUMP is going to pop the top element from the stack, which is msg.value. This is equivalent to calling jump(msg.value). It changes the PC to the address specified by our input.
The objective is to jump to address 0x08, so 8 is the correct input.