# Removing a UniswapV3Gauge via UniswapV3GaugeFactory does not actually remove it from the UniswapV3Staker. The gauge still gains rewards and can be staked too (even though deprecated). Plus old stakers can game the rewards of new stakers

Removing a UniswapV3Gauge from the factory never detaches it from UniswapV3Staker, so deprecated gauges keep earning bribes/boost while new stakers get nothing.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO Ecosystem
- Credited: ABA
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/277
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AM-35
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** UniswapV3GaugeFactory / UniswapV3Staker gauge lifecycle
**Root cause:** BaseV2GaugeFactory::removeGauge deprecates the gauge in bHermesGauges but has no afterCreateRemoved callback to update UniswapV3Staker, and staking functions never check whether the gauge is still active.
**Steps:**
1. Create a UniswapV3Gauge via UniswapV3GaugeFactory; afterCreateGauge calls uniswapV3Staker.updateGauges(pool).
2. Users vote for the gauge via bHermesGauges and stake positions in UniswapV3Staker.
3. Team calls BaseV2GaugeFactory::removeGauge, which marks the gauge deprecated in bHermesGauges but leaves UniswapV3Staker untouched.
4. Deprecated gauge still receives fees from _unstakeToken collect to bribeDepot; existing voters keep accruing bribes via accrueBribes/FlywheelCore.
5. New users call stakeToken/restakeToken on the deprecated gauge; no active-gauge check exists, so they stake but cannot vote and receive no bribe share.
6. Existing stakers also retain bHermesBoost boost via getUserGaugeBoost in _unstakeToken, while new stakers cannot obtain it.
**How found:** Code reading of the gauge factory lifecycle: noticed afterCreateGauge wires the gauge into UniswapV3Staker but no symmetric removal callback exists, then traced reward flow through accrueBribes/FlywheelCore and _unstakeToken to confirm deprecated gauges still pay out.
**Exploitation:** Pre-existing stakers/voters of a gauge that later gets removed continue to collect bribe fees and boost from UniswapV3Staker while new stakers deposit into the deprecated gauge and receive nothing, letting early depositors capture later stakers' share.
**Insight:** When a factory has an afterCreate hook that registers a child in another contract, check for a symmetric removal hook; asymmetric lifecycle wiring leaves stale registrations that keep accruing value.