# totalBorrowedCredit can revert, breaking gauges.

totalBorrowedCredit underflows when creditMultiplier drops after a loss and PSM redeemableCredit exceeds targetTotalSupply, reverting debtCeiling and blocking new borrows.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: carrotsmuggler
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/1170
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** ProfitManager.totalBorrowedCredit / SimplePSM redeemableCredit
**Root cause:** totalBorrowedCredit subtracts redeemableCredit (which scales inversely with creditMultiplier) from targetTotalSupply; after a realized loss lowers creditMultiplier, redeemableCredit can exceed targetTotalSupply, underflowing the subtraction.
**Steps:**
1. Deploy fresh market; mint 100e6 pegToken and call `psm.mint(address(this), 100e6)` to get 100e18 CREDIT.
2. Realize a loss via `profitManager.notifyPnL(address(this), -50e18)`, lowering creditMultiplier below 1e18.
3. Burn credit tokens: `credit.burn(70e18)` to drop targetTotalSupply.
4. Call `profitManager.totalBorrowedCredit()`; subtraction underflows and reverts.
**How found:** Code reading of totalBorrowedCredit's subtraction of redeemableCredit, noticing redeemableCredit divides by creditMultiplier which decreases on losses, so the two terms can cross and underflow.
**Exploitation:** Any borrower can burn their own CREDIT after a loss is realized to push targetTotalSupply below redeemableCredit, making totalBorrowedCredit revert; this breaks debtCeiling and halts new term borrows in the market.
**Insight:** When a view subtracts a value derived by dividing by a mutable multiplier (creditMultiplier) from a supply figure, check whether loss events can invert the ordering; user-controlled burns of the minuend widen the gap.