# GaugeController::remove_gauge will always revert whenever the gauge it's being called or has any weight attached to it

GaugeController.remove_gauge erases gauge type before _remove_gauge_weight, so weight subtraction underflows and reverts for any gauge with nonzero weight.

- Payout: Contest reward
- Severity: medium
- Program: Canto
- Credited: Arabadzhiev
- Disclosed: 2024-04-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-neobase-findings/issues/22
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-neobase%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** GaugeController governance contract (Solidity)
**Root cause:** remove_gauge sets gauge_types_[_gauge]=0 before calling _remove_gauge_weight, which then computes gauge_type = -1 and subtracts old weight from points_sum[-1], underflowing.
**Steps:**
1. Deploy/use GaugeController with governance account holding ve tokens.
2. `gc.add_gauge(gauge1, 0)` to register gauge.
3. `gc.vote_for_gauge_weights(gauge1, 10000)` to attach nonzero weight.
4. Call `gc.remove_gauge(gauge1)` as governance; it reverts with Panic(0x11) arithmetic underflow.
**How found:** Code reading of remove_gauge ordering: noticed gauge type erased before _remove_gauge_weight reads gauge_types_ to derive gauge_type, causing -1 index and underflow on subtraction.
**Insight:** In governance/weight bookkeeping contracts, check ordering between state erasure and cleanup routines that re-read the erased mapping; a zeroed type index becomes -1 and underflows subtractions.