# Reducing the weight of a voted gaugetype will always revert

GaugeController._changeTypeWeight underflows when reducing a gauge type's weight below its old value, reverting the admin call and blocking weight decreases.

- Payout: Contest reward
- Severity: medium
- Program: Opal
- Credited: J4X98
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.3.13
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.13
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** GaugeController.sol _changeTypeWeight / changeTypeWeight
**Root cause:** totalWeight += (oldSum * weight) - (oldSum * oldWeight) computes a negative delta when oldWeight > weight; Solidity 0.8 checked arithmetic reverts on the underflow instead of subtracting.
**Steps:**
1. Initialize gauge type 0 with weight 2e18 and add a gauge.
2. Alice locks tokens and calls `voteForGaugeWeight(gauge, 10000)` so oldSum > 0.
3. opalTeam calls `changeTypeWeight(0, 1e18)` to reduce weight.
4. Call reverts due to underflow in `(oldSum * weight) - (oldSum * oldWeight)`.
5. Run `forge test -vvvv --match-test test_revertNegativeChangeTypeWeight`.
**How found:** Code review of the weight-delta arithmetic combined with awareness that Solidity 0.8 checked math reverts on negative intermediate results; confirmed with a Foundry PoC.
**Insight:** When a function computes a signed delta as `a - b` inside an unsigned accumulator, test both directions of the change; admin 'decrease' paths are commonly untested and revert under checked arithmetic.