# Over 90% of the Guild staked in a gauge can be unstaked, despite the gauge utilizing its full debt allocation

Gauge weight tolerance (1.2x) lets stakers repeatedly unstake ~16.7% of Guild from a gauge at full debt allocation, bypassing the slash-protection invariant.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: JCN
- Disclosed: 2024-02-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/475
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-19
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** GuildToken/LendingTerm gauge staking and debt ceiling logic
**Root cause:** LendingTerm.debtCeiling applies gaugeWeightTolerance (1.2e18) to the post-decrement gauge weight, so a ~16.67% weight reduction still yields toleratedGaugeWeight == totalWeight, making debtCeilingBefore == issuance and passing the issuance <= debtCeilingAfterDecrement check even at full debt allocation.
**Steps:**
1. Set up gauge with totalWeight=2_000_000e18, issuance=2_000_000e18, totalBorrowedCredit=2_000_000e18, buffer=0, tolerance=1.2e18.
2. Call `guild.decrementGauge(term, 333333333333333333333333)` (~16.67% of weight).
3. In debtCeiling: gaugeWeight=1666666666666666666666667, toleratedGaugeWeight=(gaugeWeight*1.2e18)/1e18=2_000_000e18, debtCeilingBefore=(2_000_000e18*2_000_000e18)/2_000_000e18=2_000_000e18 == issuance, so require passes.
4. Repeat with recomputed unstakeAmount (~16.67% of remaining weight) plus small incrementGauge corrections for rounding, until >90% unstaked.
**How found:** Author reasoned about the gaugeWeightTolerance (1.2x) inflation and hypothesized that at 100% debt allocation a weight reduction could still satisfy toleratedGaugeWeight == totalWeight, then solved for the unstake amount with high precision (python) and validated in a Foundry PoC.
**Exploitation:** A staker holding Guild in a gauge at full debt allocation repeatedly calls decrementGauge with amounts sized so toleratedGaugeWeight equals totalWeight, draining their stake despite the protocol invariant that stakers cannot exit while the gauge is at its debt ceiling, thereby avoiding slashing.
**Escalation:** Iterating the ~16.67% unstake with rounding corrections compounds to >90% of staked Guild removed from the gauge.
**Insight:** When a tolerance multiplier is applied to a post-decrement value and compared against a pre-decrement-derived ceiling, solve for the delta where tolerance*(W-d) == W to find a repeatable partial-exit window; check invariants at the boundary (100% utilization) rather than mid-range.