# Incorrect calculations in debtCeiling

LendingTerm.debtCeiling applies gaugeWeightDelta only to gaugeWeight, not totalWeight, so a sole gauge is wrongly treated as capped and users cannot decrement/withdraw GUILD.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: SpicyMeatball
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/586
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-18
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LendingTerm.debtCeiling / GuildToken.decrementGauge (Solidity)
**Root cause:** debtCeiling(int256 gaugeWeightDelta) adds the delta to gaugeWeight but leaves totalTypeWeight unchanged, so the gaugeWeight==totalWeight 'unlimited ceiling' branch is never hit when decrementing the sole gauge of a type.
**Steps:**
1. Set up single gauge of a type with maxGauges, addGauge(1, term)
2. alice increments gauge by 10e18; mint 100e18 CREDIT so issuance=100e18
3. alice calls `token.decrementGauge(address(this), 8e18)`
4. debtCeiling(-8e18) computes gaugeWeight=2e18 but totalWeight stays 10e18, so gaugeWeight!=totalWeight and the relative ceiling formula returns a value < issuance
5. require(issuance <= debtCeilingAfterDecrement) reverts with 'GuildToken: debt ceiling used'
**How found:** Code reading of the decrementGauge ceiling check and the debtCeiling view: noticed the delta is applied to gaugeWeight only while totalWeight is read fresh, breaking the sole-gauge unlimited-ceiling branch; confirmed with a Foundry test.
**Insight:** When a view function takes a delta parameter, audit every derived quantity that depends on the mutated value—here totalWeight must shift by the same delta or branch conditions (gaugeWeight==totalWeight) silently flip.