# Improper tokenGasPrice design can overcharge user for the gas cost by a huge margin

Biconomy LiquidityPool computes gas fee as totalGasUsed * tokenGasPrice in token wei, overcharging low-decimal tokens like WBTC by thousands of times.

- Payout: Audit contest
- Severity: medium
- Program: Biconomy
- Found by: WatchPug
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-biconomy-findings/issues/145
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** LiquidityPool.sendFundsToUser gas fee calculation
**Root cause:** tokenGasPrice is a uint256 in token units, so the minimum chargeable amount is 1 wei of token per gas; for low-decimal tokens (WBTC 8, USDC 6) 1 wei is worth far more than actual gas, and 0 yields no fee.
**Steps:**
1. Set baseGas=21000, tokenGasPrice=1 wei for WBTC, transferFeeAmount=0, 1 WBTC=20000 MATIC.
2. Alice sends 0.1 WBTC to Bob on Polygon; Executor calls `sendFundsToUser()` with tokenGasPrice=1, totalGasUsed=42000, gas price 30 gwei.
3. gasFee = 42000 * 1 = 42000 wei WBTC; amountToTransfer = 10000000 - 42000.
4. Bob receives 0.09958 WBTC, paying 0.00042 WBTC gas vs actual 0.00126 MATIC cost (~6666x overcharge).
**How found:** Code reading of the gas fee formula in LiquidityPool.sol and reasoning about token decimals: since tokenGasPrice is integer token wei, granularity is too coarse for 6-8 decimal tokens.
**Exploitation:** Not an attack; the Executor's configured tokenGasPrice causes systematic overcharging of users on every transfer of low-decimal tokens.
**Insight:** When a fee is computed as gasUsed * price in token units, check the token's decimals: integer price granularity means the smallest unit may vastly exceed real gas cost, making fees either huge or zero.