First, we need to get enough gold to perform the save and load operations.
Looking at the source code (in particular these lines):```perlif( ($subm) <= $gold  and int($subm)>=0){    $gold   -= ($subm);    $points += ($subm)*1000;}```
We see that we must enter a value less than the amount of gold we have, but greater than zero. Notice that the first condition checks the entire value of `$subm` against `$gold`, while the second condition only checks the integer part of `$subm`. Thus, we can actually enter a value of `-0.99` gold and get `0.99` gold. If we do this 253 times, we can get enough gold to save and load.
It turns out perl has a very interesting, "feature" that is very useful (for us) when we can modify the "file name" used in `open()`. [According to the perl docs](https://perldoc.perl.org/functions/open.html#Opening-a-filehandle-into-a-command), you can open a file handle to a command.
If we try a payload like `|ls|`, then try to load a save, we see that our gold becomes```* u hav run.sh gold```Thus, we can execute arbitrary commands.
We need some way to `grep` across the entire system for `3k{` to find the flag. Unfortunately, the characters `/`, `.` and  ` `  are removed from the name, so we must find another way to get to the root and perform a `grep`.
It turns out, a space can be substituted by `${IFS%??}`. With this replacement, we can run almost any command. However, we need a way to `grep` from the root, since we are in a the user's home directory (can be checked with `|pwd|`). We can abuse environment variables to accomplish this. In particular, `dirname${IFS%??}$(dirname${IFS%??}$HOME)` will get us to `/`.
We have all the tools to find a file. Entering the name as```|grep${IFS%??}-r${IFS%??}"3k"${IFS%??}$(dirname${IFS%??}$(dirname${IFS%??}$HOME))${IFS%??}1>&2|```
will get you the flag. Note that we are redirecting `grep`'s standard output to standard error, since only the first line of standard output is loaded into `u hav ... gold`, and the flag is not the first file. On the other hand, all of standard error is visible.
The final step is to find all the `Permission Denied` (among other things) standard error junk, which can be done trivially with another `grep` locally.
**Flag:** `3k{p333rl_aInt_7hat_deAd_Y3t}`