> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web3-ctf/evm-puzzles/puzzle-5.md).

# Puzzle 5

DUP, MUL, PUSH, EQ, JUMPI

## Puzzle

```
############
# Puzzle 5 #
############

00      34          CALLVALUE
01      80          DUP1
02      02          MUL
03      610100      PUSH2 0100
06      14          EQ
07      600C        PUSH1 0C
09      57          JUMPI
0A      FD          REVERT
0B      FD          REVERT
0C      5B          JUMPDEST
0D      00          STOP
0E      FD          REVERT
0F      FD          REVERT

? Enter the value to send: (0) 
```

## Solution

Up until address `0x06`, the program compares `msg.value ** 2` with `0x100`. Since we want `JUMPI(0x0C, 1)` in order to jump to address `0x0C`, we need `msg.value ** 2 == 0x100`. `0x100` is 256 in decimal, so our input should be `sqrt(256)` = 16.