# Improper totalvotes calculation by referring to numbergauges instead of gaugetypes

GaugeController._getTotal loops over numberGauges instead of numberGaugeTypes, so gauge types beyond the gauge count are skipped and their votes omitted from totalVotes.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: innertia
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.15
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.15
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** GaugeController.sol _getTotal() vote tallying
**Root cause:** _getTotal() uses numberGauges as the loop bound while indexing per-gauge-type arrays; when gauge types outnumber gauges, trailing types are never summed into totalVotes.
**Steps:**
1. Deploy 4 gauge types (indices 0-3).
2. Create 3 gauges assigned types 0, 2, 3.
3. numberGauges=3 so loop runs i=0..2, covering types 0,1,2 only.
4. Type 3 votes (gauge3) never added to totalVotes.
5. Observe totalVotes undercounts weighted votes; types/gauges cannot be deleted so state persists.
**How found:** Code reading of _getTotal(): noticed loop bound numberGauges but loop body indexes gauge-type-dependent variables; constructed a case where gaugeTypes count exceeds gauges count to show skipped types.
**Exploitation:** Not described beyond the miscalculation; incorrect totalVotes skews weight-multiplied vote accounting in the gauge voting system.
**Insight:** When a loop bound and the arrays it indexes are keyed by different counters (gauges vs gauge types), construct sparse-assignment cases where one count exceeds the other to expose skipped or out-of-range iterations.