Due to freely staking (`incrementGauge`) and unstaking(`decrementGauge`), a guild holder can (1) steal interest payed to stakers and (2) avoid being slashed. 
Audit: 2023-12-ethereumcreditguild-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/tokens/GuildToken.sol#L258
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/ProfitManager.sol#L396-L399
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/tokens/GuildToken.sol#L220


# Vulnerability details

## Impact
A GUILD bag holder can monitor the mempool. When he observe an interest payment to a specific gauge he frontrun and increment that gauge weight and steal the  rewards allocated to guild stakers. 
On the same idea the guild bag holder can front run a bad debt realization tx and decrement his weight to avoid being slashed. 


## Proof of Concept
`profitManager.notifyPnL` is called when an interest is paid to the protocol or when a bad debt is realized. 
 A guild holder can monitor the mempool for these 2 types of transactions and front-run the tx in his benefit:
 
 A. 
 - he can `incrementGauge` before interest is payed. `claimGaugeRewards` is [called](https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/tokens/GuildToken.sol#L258). `getUserGaugeWeight` is 0 (it's updated later, returns prvious user gauge weight), `claimGaugeRewards` [returns 0](https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/ProfitManager.sol#L417C16-L417C16) meaning that `userGaugeProfitIndex` is not updated.
 
 - interest is payed, `notifyPnL` is called and `gaugeProfitIndex` is [updated](https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/ProfitManager.sol#L396-L399) (increased).
 - user `decrementGauge`. `claimGaugeRewards` is [called](https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/tokens/GuildToken.sol#L220). `deltaIndex` is > 0 and a pro rata share of `creditEarned` amount is payed.

 User got payed for staking for only 2 consecutive blocks. He has exposure to the interest payed to guild stakers while avoiding the risk of being slashed. Long term stakers (gauge weight voters) get diminished returns while they (1)  ensure a minimum credit limit and (2) are at risk of slashing.

 B. The front running a bad debt realization is also true. A guild holder who notices a transaction at a loss (eg. `forgive`) can front run it to avoid being slashed.


## Tools Used
Manual review

## Recommended Mitigation Steps
I'm not entirely familiar with the gauges functionality but it seems the original `cycle` mechanism had the role to avoid this kind of issue. 

Reconsider [removing](https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/tokens/ERC20Gauges.sol#L53) cycle based logic or implement a minimum lock up  period for gauge