> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web3-ctf/evm-puzzles/puzzle-1.md).

# Puzzle 1

CALLVALUE, JUMP, JUMPDEST

## Puzzle

```
############
# Puzzle 1 #
############

00      34      CALLVALUE
01      56      JUMP
02      FD      REVERT
03      FD      REVERT
04      FD      REVERT
05      FD      REVERT
06      FD      REVERT
07      FD      REVERT
08      5B      JUMPDEST
09      00      STOP

? Enter the value to send: (0) 
```

## Solution

Look up `CALLVALUE` on [evm.codes](https://www.evm.codes/?fork=merge):

> Get deposited value by the instruction/transaction responsible for this execution

In other words, `CALLVALUE` pushes msg.value onto the stack. In this puzzle, our input is used as msg.value.

After that, `JUMP` is going to pop the top element from the stack, which is msg.value. This is equivalent to calling `jump(msg.value)`. It changes the PC to the address specified by our input.

The objective is to jump to address `0x08`, so 8 is the correct input.