# FeeRefund.tokenGasPriceFactor is not included in signed transaction data allowing the submitter to steal funds

Biconomy SmartAccount omits tokenGasPriceFactor from signed tx data, letting a relayer inflate ERC20 gas refunds and drain the wallet.

- Payout: Contest reward
- Severity: high
- Program: Biconomy
- Credited: Ruhum
- Disclosed: 2023-03-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-01-biconomy-findings/issues/123
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-biconomy%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:signature-replay

**Target:** SmartAccount.sol ERC20 gas refund logic
**Root cause:** encodeTransactionData() hashes baseGas, gasPrice, gasToken and refundReceiver but not tokenGasPriceFactor, so the owner's signature does not bind the divisor used to compute ERC20 refunds in handlePayment().
**Steps:**
1. Owner signs a Transaction with refundInfo where tokenGasPriceFactor=18 (e.g. gasUsed=1e6, baseGas=1e5, gasPrice=10 gwei).
2. Submitter takes the signed payload and calls execTransaction() with tokenGasPriceFactor=1 instead.
3. Signature verification passes because tokenGasPriceFactor is not in the encoded hash.
4. handlePayment() computes payment = (gasUsed+baseGas)*gasPrice/1 = 1.1e16 instead of 6.11e14, paying the submitter 18x the intended ERC20 refund.
**How found:** Code review of encodeTransactionData() against handlePayment(), noticing the refund divisor used in payment math was absent from the signed struct hash.
**Exploitation:** A relayer/submitter simulates a tx with a fair tokenGasPriceFactor to obtain the owner's signature, then resubmits the same signed data with tokenGasPriceFactor=1, causing transferToken() to pay out a multiplied ERC20 refund to refundReceiver/tx.origin, draining the wallet's gas token balance.
**Insight:** When auditing meta-transaction/refund schemes, diff every field consumed in payment math against the fields included in the signed typehash; any refund-affecting parameter outside the hash is attacker-controlled.