Simple question, but I couldn’t find the answer anywhere.
I know CALL is used and sometimes CALLER, but I don’t have any idea on how msg.sender.call.value(100) would be performed.

1 Answer 1


The EVM is a stack machine, so arguments to instructions are put on a stack before the instruction is executed. You can find the parameters each instruction takes as well as their order in the yellow paper or in your favorite EVM implementation, e.g. here for the CALL instruction:

gas, to, value, meminstart, meminsz, memoutstart, memoutsz = \
    stk.pop(), stk.pop(), stk.pop(), stk.pop(), stk.pop(), stk.pop(), stk.pop()

Therefore, a CALL needs the available gas on top of the stack, then the destination address, value, input memory offset etc.

A valid instruction chain could simply look like this:

PUSH32 <memoutsz>
PUSH32 <memoutstart>
PUSH32 <meminsz>
PUSH32 <meminstart>
PUSH32 <value>
PUSH20 <to>
PUSh32 <gas>

Edit: meminstart and meminsz define the input data for the call, which usually are the function arguments for the called contract. meminstart is the offset in the memory and meminsz is the size of the data. If you just want to send ether to a contract, you can set both of them to 0.

memoutstart and memoutsz define an area in the memory where the return data of the call is stored at (if there is any).

  • What’s meminstart meminsz memoutstart memoutsz? Commented Jun 1, 2018 at 18:20
  • @user2284570 Added an explanation to my answer.
    – mafrasi2
    Commented Jun 1, 2018 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.