Skip to content

Latest commit

 

History

History
23 lines (12 loc) · 1.38 KB

Puzzle6.md

File metadata and controls

23 lines (12 loc) · 1.38 KB
Raw

Analysis

Let's break down the bytecode and understand the flow of execution to find the answer:

  1. PUSH1 00: Pushes the value 00 (0 in decimal) onto the stack.

  2. CALLDATALOAD (35): This opcode loads 32 bytes of calldata starting from the position indicated by the top value of the stack (which is 00) and pushes this data onto the stack. Since the position is 0, it loads the first 32 bytes of calldata.

  3. JUMP (56): This opcode alters the program counter to the location specified by the top stack item. It jumps to the location if it's a valid JUMPDEST.

  4. JUMPDEST (5B): Marks a valid destination for jumps.

  5. STOP (00): Halts execution.

Execution

  • For the JUMP at byte 03 to be successful, CALLDATALOAD must push the address of JUMPDEST, which is 0A, onto the stack.

  • Since CALLDATALOAD loads the first 32 bytes of calldata and the EVM is big-endian, the least significant byte of these 32 bytes needs to be 0A to make the entire 32-byte word represent the value 0A when interpreted in a big-endian format. The other bytes can be zeros.

  • Valid Sequence: 0x000000000000000000000000000000000000000000000000000000000000000A

This sequence ensures that CALLDATALOAD will interpret the first 32 bytes as a 32-byte word ending in 0A, which is then pushed onto the stack, allowing the JUMP instruction to successfully target the JUMPDEST at byte 0A.