# Attacker can gain control of counterfactual wallet

Counterfactual wallet address ignores entrypoint, letting attacker deploy with malicious entrypoint and drain pre-funded wallet.

- Payout: Contest reward
- Severity: high
- Program: Biconomy
- Credited: adriro
- Disclosed: 2023-03-03
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-biconomy-findings/issues/460
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-biconomy%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** SmartAccountFactory / SmartAccount
**Root cause:** deployCounterFactualWallet computes CREATE2 salt only from owner and index, excluding the entrypoint address, so an attacker can deploy the same address with an arbitrary entrypoint.
**Steps:**
1. Precompute counterfactual address: `factory.getAddressForCounterfactualWallet(bob, 0)`
2. Attacker deploys `StealEntryPoint` contract
3. Attacker calls `factory.deployCounterFactualWallet(bob, address(stealer), handler, 0)`
4. Attacker calls `stealer.steal(wallet)` which invokes `wallet.execFromEntryPoint(attacker, balance, "", Call, gasleft())`
5. Wallet sends its entire ETH balance to attacker
**How found:** Researcher noticed that the entrypoint parameter is not part of the CREATE2 salt or init code hash, so the same counterfactual address can be deployed with a different entrypoint.
**Exploitation:** Attacker front-runs the legitimate deployment by calling deployCounterFactualWallet with a malicious entrypoint contract. Since the resulting address matches the precomputed one, the attacker's entrypoint is set as the wallet's entrypoint. The attacker then calls execFromEntryPoint via the malicious entrypoint to transfer all funds or execute arbitrary calls (including delegatecall) from the wallet.
**Escalation:** Attacker can also change ownership or execute arbitrary delegatecalls, gaining full control of the wallet and any assets it holds.
**Insight:** When auditing counterfactual wallet factories, verify that all security-critical initialization parameters (entrypoint, handler, implementation) are included in the address derivation to prevent front-running with malicious configuration.