Executive brief
Gardens v2 is a blockchain governance framework that manages escrow accounts for community proposals with customizable voting mechanisms. A flaw in its streaming escrow system allows anyone to bypass dispute protections and transfer escrowed tokens to a proposal beneficiary even while the proposal is under challenge. If the proposal is later rejected, those tokens cannot be recovered, resulting in permanent loss of community funds.
Technical details
The vulnerability is an authorization bypass in the StreamingEscrow smart contract (StreamingEscrow.sol). The claim() function correctly checks the disputed flag and rejects withdrawals during disputes, but the public syncOutflow() function performs the same excess-balance transfer to the beneficiary without verifying the disputed status. An attacker can call the permissionless syncOutflow() function repeatedly to drain accumulated excess tokens to a beneficiary while a proposal is disputed. The vulnerability affects the dispute resolution workflow: after a streaming proposal is challenged, the dispute flag blocks new outflows but does not prevent accumulation; syncOutflow() then transfers this accumulated excess despite the active dispute. If the proposal is later rejected, drainToStrategy() cannot recover already-transferred tokens. The patch adds a disputed check before draining excess in syncOutflow().
Affected products
- 1Hive Gardens v2 before 0xc9d4e0dacd937364793278180551e59d93cd43f9
Timeline
- 2026-06-01: disclosed: GitHub Security Advisory GHSA-jxgc-cgfq-436j published
- 2026-09-03: advisory: CVE-2026-53924 published on NVD
- 2026-06-01: patched: Patched in commit 0xc9d4e0dacd937364793278180551e59d93cd43f9