Challenge:
Our ninth challenge is located in /puzzles/puzzle_9.json. Challenge 9 contains the following:
{
"code": "36600310600957FDFD5B343602600814601457FD5B00",
"askForValue": true,
"askForData": true
}
Hint 1:
The corresponding EVM opcodes are:
CALLDATASIZE
PUSH1 03
LT
PUSH1 09
JUMPI
REVERT
REVERT
JUMPDEST
CALLVALUE
CALLDATASIZE
MUL
PUSH1 08
EQ
PUSH1 14
JUMPI
REVERT
JUMPDEST
STOP
Hint 2:
We have 2 new opcodes here: LT and MUL.
LT checks that the value on the top of the stack
is less than the value directly below it on the stack.
It will place the result (1 for true or 0 for false)
on the top of the stack.
MUL multiplies the two values on the top of the stack
and places the result on top of the stack.
What should our calldata and call value be so that
we can pass both comparison checks and jump over all
of the REVERT opcodes?
Hint 3:
Remember, CALLDATASIZE places the size of call data in bytes on the
stack and CALLVALUE places the call value directly on the stack.
Solution:
This one is pretty straightforward. We can see that we need our calldata
to be greater than 3 as we want the LT comparison to be true.
The second check we need to pass is we want our calldata * call value
to be equal to 8.
A solution to this is any 4 bytes of calldata and 2 wei for our call value.
Solution:
calldata: 0xFFFFFFFF call value: 2