Skip to content

Latest commit

 

History

History
56 lines (30 loc) · 2.09 KB

Puzzle9.md

File metadata and controls

56 lines (30 loc) · 2.09 KB

Analysis

  1. CALLDATASIZE (36): Pushes the size of the calldata (in bytes) onto the stack.

  2. PUSH1 03 (6003): Pushes the value 03 onto the stack.

  3. LT (10): Compares the calldata size with 03. Pushes 1 (true) if less than 03, otherwise 0 (false).

  4. PUSH1 09 (6009): Pushes the value 09 onto the stack.

  5. JUMPI (57): Conditionally jumps to byte 09 if the top stack item is 1.

  6. REVERT (FD): Reverts the transaction if the jump is not executed.

  7. JUMPDEST (5B) at 09: Marks a valid jump destination.

  8. CALLVALUE (34): Pushes the value sent with the transaction onto the stack.

  9. CALLDATASIZE (36): Pushes the size of the calldata onto the stack again.

  10. MUL (02): Multiplies the transaction value and the calldata size.

  11. PUSH1 08 (6008): Pushes the value 08 onto the stack.

  12. EQ (14): Checks if the multiplication result equals 08.

  13. PUSH1 14 (6014): Pushes the value 14 onto the stack.

  14. JUMPI (57): Conditionally jumps to byte 14 if the multiplication result equals 08.

  15. REVERT (FD): Reverts the transaction if the jump is not executed.

  16. JUMPDEST (5B) at 14: Marks another valid jump destination.

  17. STOP (00): Halts execution.

Execution

To successfully reach the STOP instruction without reverting:

  • The calldata size must be greater than or equal to 3 bytes to avoid the first revert.
  • The product of the transaction value (CALLVALUE) and the calldata size (CALLDATASIZE) must equal 8.

Solution

To meet these requirements, the calldata size and transaction value need to be chosen such that:

  • CALLDATASIZE ≥ 3
  • CALLVALUE × CALLDATASIZE = 8

Possible solutions include:

  • Calldata: 0xFFFFFFFFFFFFFFFF (8 bytes) and Transaction Value: 1 wei. Here, CALLDATASIZE is 8, and the product with CALLVALUE (1 wei) equals 8.
  • Calldata: 0xFFFFFFFF (4 bytes) and Transaction Value: 2 wei. In this case, CALLDATASIZE is 4, and the product with CALLVALUE (2 wei) also equals 8.

These configurations satisfy both conditions, allowing the bytecode execution to reach the STOP opcode successfully.