# Removing a BribeFlywheel from a Gauge does not remove the reward asset from the rewards depo, making it impossible to add a new Flywheel with the same reward token

BaseV2Gauge.removeBribeFlywheel deletes the flywheel but never calls MultiRewardsDepot.removeAsset, so re-adding a flywheel with the same reward token reverts, permanently blocking that bribe token.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: ABA
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/214
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-28
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BaseV2Gauge / MultiRewardsDepot bribe flywheel management
**Root cause:** removeBribeFlywheel only deletes isActive[bribeFlywheel] and never removes the flywheel's reward token from multiRewardsDepot, so the asset entry persists while the flywheel is gone.
**Steps:**
1. Deploy UniswapV3Gauge and call BaseV2GaugeFactory.addBribeToGauge, which routes to BaseV2Gauge.addGaugetoFlywheel and calls multiRewardsDepot.addAsset for the bribe reward token.
2. Owner calls BaseV2GaugeFactory.removeBribeFromGauge -> BaseV2Gauge.removeBribeFlywheel, which deletes isActive[bribeFlywheel] but does not call MultiRewardsDepot.removeAsset.
3. Attempt to add a new flywheel with the same reward token via addBribeToGauge -> addGaugetoFlywheel -> multiRewardsDepot.addAsset.
4. addAsset reverts with ErrorAddingAsset because the asset is still registered in the depot.
**How found:** Code reading of removeBribeFlywheel versus addGaugetoFlywheel: noticed add path calls multiRewardsDepot.addAsset but the symmetric remove path never calls removeAsset, then traced the revert on re-add.
**Insight:** When auditing paired add/remove admin functions, diff their side effects on shared registries (depots, allowlists, mappings); asymmetric cleanup of an asset/strategy registry silently bricks re-registration of the same key.