# LendingTerm debtCeiling function uses creditMinterBuffer incorrectly

LendingTerm.debtCeiling caps total debt at creditMinterBuffer instead of issuance+buffer, so gauge decrements revert when issuance exceeds remaining buffer, blocking voters/stakers from exiting.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: niroh
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/868
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** LendingTerm.debtCeiling / GuildToken.decrementGauge (Solidity)
**Root cause:** debtCeiling returns min(hardCap, creditMinterBuffer) treating the buffer as a cap on total debt, but the buffer limits only additional borrows; the correct cap is issuance + creditMinterBuffer.
**Steps:**
1. Deploy/fork Credit Guild integration test setup; allocate a gauge to a term (testAllocateGaugeToSDAI).
2. Borrow 51% of rateLimitedCreditMinter.buffer() via _supplyCollateralUserOne so term issuance exceeds remaining buffer.
3. Call `guild.decrementGauge(address(term), guild.balanceOf(address(this)) * 2 / 100)`.
4. Observe revert `GuildToken: debt ceiling used` even though post-decrement debtCeiling should exceed issuance.
**How found:** Code review of debtCeiling's two min(hardCap, creditMinterBuffer) branches; noticed buffer semantics (additional borrows) differ from hardCap (total), then wrote a Foundry PoC showing a 2% decrement reverting.
**Exploitation:** A borrower (or naturally high demand) raises a term's issuance above the remaining creditMinterBuffer; any subsequent decrementGauge call reverts in GuildToken._decrementGaugeWeight because debtCeiling() returns the buffer alone, locking voters and surplusGuildMinder stakers into the gauge.
**Escalation:** Malicious actor can deliberately borrow to push issuance above the buffer, DOS-ing exits; locked stakers may later be slashed if the term incurs losses.
**Insight:** When a shared limit variable is reused in multiple cap computations, check whether it bounds a delta (additional) or an absolute (total); mixing them silently understates ceilings and can brick state-changing exits that depend on the ceiling check.