# It is possible to DoS all the functions related to some gauge in GaugeController

GaugeController._get_weight underflows pt.slope when governance lowers then raises a gauge's weight, permanently bricking all gauge functions and locking votes.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Credited: bart1e
- Disclosed: 2023-10-11
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-08-verwa-findings/issues/206
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:dos vuln:governance

**Target:** GaugeController.sol _get_weight / gauge weight accounting
**Root cause:** change_gauge_weight lowers bias without touching slope; when bias later hits zero the else branch zeroes slope, but a subsequent weight increase leaves bias>0 with slope=0, so subtracting a pending changes_weight entry underflows.
**Steps:**
1. gov calls `change_gauge_weight(gauge1, 0)` lowering bias while slope stays
2. users vote, then withdraw over time; `_get_weight` else branch sets pt.bias=0 and pt.slope=0
3. gov calls `change_gauge_weight(gauge1, 1 ether)` raising bias but slope remains 0
4. a user's voting power ends at a future t with `changes_weight[gauge][t] > 0`
5. `_get_weight` enters if-branch, `pt.slope -= d_slope` underflows and reverts
6. all gauge functions (vote_for_gauge_weights, change_gauge_weight, remove_gauge, checkpoint_gauge) now revert permanently
**How found:** Code reading of _get_weight's loop: noticed change_gauge_weight modifies bias but not slope, and that the else branch zeroes slope; reasoned that a later bias increase with pending changes_weight would underflow.
**Exploitation:** Attacker with capital frontruns a governance weight decrease, allocates matching voting power, then withdraws right after, leaving gauge at zero slope/bias; governance's recovery increase triggers the permanent underflow DoS, locking all votes on that gauge.
**Escalation:** Frontrunning the governance decrease lets an attacker force the zero-slope state without waiting for natural withdrawal, making the DoS reliably triggerable.
**Insight:** When a setter updates one accumulator (bias) but not its paired rate (slope), look for later code that subtracts a delta from the untouched rate — the mismatch between manually-set bias and stale slope is where underflow/DoS hides.