> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web3-ctf/evm-puzzles/puzzle-2.md).

# Puzzle 2

CODESIZE, SUB

## Puzzle

```
############
# Puzzle 2 #
############

00      34      CALLVALUE
01      38      CODESIZE
02      03      SUB
03      56      JUMP
04      FD      REVERT
05      FD      REVERT
06      5B      JUMPDEST
07      00      STOP
08      FD      REVERT
09      FD      REVERT

? Enter the value to send: (0) 
```

## Solution

`CALLVALUE` pushes msg.value onto the stack. `CODESIZE` pushes the size of this opcode sequence (which is 10) onto the stack. `SUB` pops two elements from the stack, subtracts them, and pushes the result back to the stack. At this moment the stack contains only one element `10-msg.value`. `JUMP` will jump to `10-msg.value`.

The objective is to jump to address `0x06`, so we want `10-msg.value = 0x06`, therefore the correct input is 4.