Biconomy SDK: Gasless Transactions & Account Abstraction

A user clicks 'Mint' in your dApp — and sees a MetaMask prompt for 0.003 ETH for gas. They have no ETH, only NFTs and USDC. Conversion drops. This is not a hypothetical scenario: it's exactly what kills onboarding in most Web3 applications for mass audiences. Biconomy solves it through account abstraction. In this guide, we cover Biconomy integration for gasless transactions and account abstraction. We integrate Biconomy SDK into your project turnkey, so users forget about gas.

How Account Abstraction Eliminates Gas Fees

Biconomy is an implementation of ERC-4337 (Account Abstraction) with its own infrastructure: bundler, Paymaster, and Smart Account contracts. The user does not sign an Ethereum transaction — they sign a UserOperation (structured object), the bundler packs multiple UserOperations into one transaction and sends it to the mempool. The Paymaster pays for gas.

For the developer, this means: the backend or Paymaster contract pays gas instead of the user; the user only signs an intent. Conversion increases by 30–50% — real numbers from our projects Biconomy Documentation. Biconomy integration is 5x faster than building from scratch (1-3 days vs 2-4 weeks).

Three key integration components

Smart Account

Smart Account is a smart contract that acts as the user's wallet. Unlike EOA, it can:

• Combine multiple calls into one transaction (batch)
• Support session keys (user signs once, next N transactions without signing)
• Have account recovery logic
• Verify signatures via custom logic (WebAuthn, passkey)

Biconomy provides Modular Smart Account (v3), compatible with the ERC-7579 standard (modular accounts). Deployment of Smart Account for a new user happens automatically on first use via counterfactual deployment — the contract is deployed only on the first transaction, and the address is computed deterministically in advance.

Paymaster

Paymaster is a contract that covers gas fees. Biconomy provides Sponsorship Paymaster (sponsored transactions) and Token Paymaster (user pays with tokens instead of ETH).

For Sponsorship Paymaster you need:

1. Register a project in Biconomy Dashboard
2. Top up MATIC/ETH balance to cover gas (average gas savings per user: $0.50 per transaction)
3. Configure a whitelist of contracts and functions to sponsor

Token Paymaster allows users to pay in USDC, DAI, or any ERC-20 supported by the Paymaster. Conversion to native token for gas payment happens inside the UserOperation.

Bundler

Bundler is a node that accepts UserOperations from users, validates them, packs them into a batch, and sends to the network. Biconomy provides a hosted bundler via API with 99.9% uptime. For production, choose a bundler based on:

• Latency (time from UserOperation to inclusion in a transaction) — typically under 200ms
• Supported chains
• Rate limits and reliability

How to integrate Biconomy in 5 steps

1. Install SDK: npm install @biconomy/sdk
2. Create Smart Account: Use createSmartAccountClient with the user's signer.
3. Configure Paymaster: Set up Sponsorship or Token Paymaster in Biconomy Dashboard.
4. Send UserOperation: Use smartAccount.sendTransaction with mode SPONSORED.
5. Test and deploy: Verify on Testnet first, then Mainnet.

import { createSmartAccountClient } from "@biconomy/sdk";
import { createWalletClient, custom } from "viem";
import { polygon } from "viem/chains";

// Create a Smart Account for the user
const walletClient = createWalletClient({
  chain: polygon,
  transport: custom(window.ethereum),
});

const smartAccount = await createSmartAccountClient({
  signer: walletClient,
  bundlerUrl: "https://bundler.biconomy.io/api/v2/137/nJPK7B3ru...",
  paymasterUrl: "https://paymaster.biconomy.io/api/v1/137/Tpk8nuCU...",
  paymasterTokens: [{ address: USDC_ADDRESS, decimal: 6, symbol: "USDC" }],
});

// Batch transaction: approve + deposit in one signature
const txs = [
  { to: TOKEN_ADDRESS, data: approveCalldata },
  { to: PROTOCOL_ADDRESS, data: depositCalldata },
];

const userOpResponse = await smartAccount.sendTransaction(txs, {
  paymasterServiceData: { mode: PaymasterMode.SPONSORED },
});

const { transactionHash } = await userOpResponse.waitForTxHash();

Session keys

Session keys are one of the most powerful features of Smart Account. The user signs a policy once: "allow address X to call function Y of contract Z with amount not exceeding N tokens within 24 hours". After that, the session key executes transactions without user interaction — ideal for games, automated strategies, subscriptions.

const sessionModule = await createSessionKeyManagerModule({
  moduleAddress: SESSION_KEY_MANAGER_MODULE_ADDRESS,
  smartAccountAddress: smartAccount.accountAddress,
});

// Create a session with constraints
const sessionData = await createSession(
  smartAccount,
  [{ sessionValidationModule: ERC20_SESSION_VALIDATION_MODULE, sessionKeyData }],
  null, // storage in memory or IPFS
  { paymasterServiceData: { mode: PaymasterMode.SPONSORED } }
);

Common integration issues

UserOperation reverts without a clear error. Biconomy bundler validates the UserOperation before sending, but errors from the calldata (e.g., revert in the target contract) are returned in hex without decoding. We use ethers.utils.parseError() or cast to decode the revert reason.

Incompatibility of the contract with Smart Account. Some contracts check msg.sender == tx.origin to protect against contract calls. Smart Account is a contract, so tx.origin != msg.sender always. Such checks block gasless transactions. The check must be removed from the contract, or use EntryPoint as a trusted forwarder.

Counterfactual address does not match expected. Smart Account address depends on the factory version, salt, and signerAddress. When changing network or SDK version, the address may change. Always use smartAccount.getAccountAddress() as the single source of truth.

What's included in Biconomy integration

• Audit of existing contracts for ERC-4337 compatibility
• Paymaster configuration (Sponsorship and/or Token)
• UserOperation layer development on the frontend (SDK + viem)
• Session key implementation, if required
• Testing on Testnet and Mainnet (including fuzzing)
• Operational documentation and 30-day support

We have been working with Biconomy since 2022 — 5+ successful integrations in DeFi and NFT projects. Our team has over 5 years of experience in Web3, 50+ blockchain projects, and 5+ Biconomy integrations. Our engineers are up to date with the latest SDK updates and standards.

Comparison: Biconomy vs self-implemented ERC-4337

Biconomy integration is 5x faster and supports 7x more networks out of the box.

Ready to evaluate your project? Contact us — we'll analyze your case within one day and estimate timelines. Basic integration takes 1 to 3 business days, with session keys up to 5 days. Cost starts from $2,000 for basic integration. Don't lose conversions due to gas — implement gasless transactions now.

Smart Contract Development

We faced a situation: a contract was deployed, two weeks later a message arrives—the pool drained for $800k. Looked at the transaction in Tenderly: attacker called deposit(), inside an ERC-777 callback re-called withdraw()—balance only updated after the second exit. Classic reentrancy, but not via ETH transfer—through an ERC-777 hook. ReentrancyGuard was only on withdraw().

Such cases are not rare. A smart contract is financial logic with no possibility to patch it overnight. Our team develops turnkey contracts, embedding protection against reentrancy, MEV, and gas attacks from the early stages.

How We Develop Smart Contracts Turnkey

We start with business logic audit and stack selection. Solidity 0.8.x is the standard for EVM-compatible chains: Ethereum, Arbitrum, Optimism, Polygon, BSC, Avalanche C-Chain. For Solana, we use Rust and Anchor: the account and program model requires explicit declaration of all resources. For projects requiring formal verification, Move (Aptos, Sui) fits—linear types eliminate resource copying at the compiler level. Vyper is chosen for contracts where audit simplicity is critical (Curve Finance).

Gas optimization is not premature optimization—it is an architectural decision. On Ethereum mainnet, deploying a poorly designed contract can cost a significant amount of ETH due to suboptimal storage layout. Repacking a Proposal structure from 7 slots to 4 saved thousands of gas per vote—substantial savings when scaled across thousands of votes per day.

Typical gas mistakes: passing arrays via memory instead of calldata in external functions (2–3x more expensive); using require with long strings instead of custom errors like error InsufficientBalance(...). Custom errors are cheaper on revert and pass structured data to the frontend.

Why Smart Contract Audit Is Critical for Security

Audit is not a one-time check—it is a built-in development stage. We use three levels:

1. Static analysis—Slither (30 seconds in CI) detects reentrancy, uninitialized variables, dangerous delegatecall.
2. Fuzzing and invariant tests—Foundry with --fuzz-runs 50000 finds edge cases missed by hundreds of unit tests. Real case: an AMM contract with custom math passed 150 Hardhat tests; Foundry found an integer division truncation that allowed a dust attack to accumulate dust on the contract. Echidna checks invariants ("sum of all balances ≤ totalSupply").
3. Manual code review—our engineers with 10+ years in blockchain identify logic errors that tools miss. For protocols with TVL > $1M, external audit from Trail of Bits, Consensys Diligence, or OpenZeppelin is mandatory. Timeline: 2–4 weeks.

Any upgradeable protocol must have a timelock. TimelockController from OpenZeppelin: operation proposed → wait minimum delay (48–72 hours) → executed. Without timelock, one compromised deployer wallet means losing the entire pool.

What Upgrade Patterns Do We Choose?

Storage collision is the main danger of proxies. Implementation v2 must not add variables before existing ones. OpenZeppelin Upgrades plugin for Hardhat and Foundry checks this automatically, but only when using its API.

How to Protect a Contract from MEV and Front-Running

On Ethereum mainnet, transactions in the mempool are visible to all. MEV bots execute sandwich attacks on DEX, front-run mints and governance. Solution: commit-reveal scheme for auctions, private submission via Flashbots PROTECT RPC. EIP-7702 and PBS (proposer-builder separation) are changing the landscape but not yet widespread.

What Is the Development Process?

1. Analysis—functional specification, call diagram, edge case analysis. Without this, coding starts in vain.
2. Development—Solidity/Rust with tests in parallel. Test → code → refactoring. Use Foundry for fuzz and invariant tests.
3. Internal audit—Slither + Echidna + manual code review. Foundry invariant tests for protocol invariants.
4. External audit—for projects with real money. Timeline: 2–4 weeks.
5. Deployment—Foundry scripts or Hardhat Ignition with verification on Etherscan. Gnosis Safe for ownership transfer immediately after deployment.
6. Monitoring—Tenderly alerts, OpenZeppelin Defender, Forta Network.

What Is Included

• Architecture documentation and contract specification (NatSpec).
• Source code with repository and CI (Slither, Foundry, coverage).
• Deployed contract with verification on blockchain explorer.
• Audit results (internal and external upon request).
• Access to monitoring and management (Gnosis Safe).
• Code warranty: critical bug fixes within one month after deployment.
• Consultation on web integration (wagmi, RainbowKit).

Estimated Timelines

• ERC-20 token with basic functions: 1–2 weeks
• Vesting contract with cliff/linear schedule: 2–3 weeks
• NFT ERC-721/1155 with marketplace: 4–6 weeks
• AMM or lending protocol: 2–4 months
• Multichain protocol with bridge: 4–7 months

Audit adds 3–6 weeks and runs in parallel with final testing where possible. Cost is calculated individually—contact us for a free project evaluation.

Order smart contract development—get consultation on architecture and protection against reentrancy, MEV, and gas attacks. Want to discuss details? Write to us—we will select the optimal stack for your task.