# The gauge status wasn't checked before reducing the user's gauge weight.

Offboarded gauge still allowed GUILD holders to decrement weight, letting them dodge slashing and shift losses to passive holders and credit token holders.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: 0xpiken
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/651
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation vuln:reward-distribution

**Target:** GuildToken gauge weight / LendingTermOffboarding
**Root cause:** GuildToken._decrementGaugeWeight does not check whether the gauge is deprecated/offboarded before allowing weight reduction, so holders can exit an offboarded term before a pending loss is realized.
**Steps:**
1. Deploy term2 with same gauge type as term1; addGauge(1, term2).
2. Carol increments gauge on term and term2 with 1e18 each.
3. Bob proposes and supports offboarding of term; offboard(term) sets isGauge(term)=false and pauses PSM redemptions.
4. Carol calls `guild.decrementGauge(address(term), 1e18)` — succeeds despite term being offboarded.
5. Carol's weight on term drops to 0, avoiding future slashing on that term.
**How found:** Reading the offboarding flow (PSM redemption pause, cleanup unpause) and noticing that decrementGauge has no deprecated-gauge guard, then writing a Foundry PoC to confirm weight can be removed post-offboarding.
**Exploitation:** A GUILD holder with weight on a term being offboarded calls decrementGauge after offboarding but before bad debt is realized, withdrawing their stake so the eventual slash/loss falls on remaining passive holders and credit token holders instead.
**Insight:** When a protocol pauses exits on one asset (PSM redemptions) during offboarding, check every other exit path (gauge weight, rewards claims, delegation) for the same missing pause — asymmetric exit controls let insiders front-run losses.