CVE-2026-53924: 1Hive Gardens v2 unauthorized fund transfer in StreamingEscrow

CVE-2026-53924 · Severity: info · CVSS 7.5 · Published 2026-09-03

Gardens v2 is a blockchain governance framework that manages escrow accounts for community proposals with customizable voting mechanisms. A flaw in its streaming escrow system allows anyone to bypass dispute protections and transfer escrowed tokens to a proposal beneficiary even while the proposal is under challenge. If the proposal is later rejected, those tokens cannot be recovered, resulting in permanent loss of community funds.

Technologies: 1Hive Gardens v2. Vendors: 1Hive.

Quick answers

Is CVE-2026-53924 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53924 being exploited in the wild.
How severe is CVE-2026-53924?
Informational severity, with a CVSS score of 7.5, published 3 September 2026.
Which products and versions are affected?
1Hive Gardens v2 before 0xc9d4e0dacd937364793278180551e59d93cd43f9.
Is there a fix for CVE-2026-53924?
A patch was published on 2026-06-01: Patched in commit 0xc9d4e0dacd937364793278180551e59d93cd43f9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53924 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53924?
Check whether you run 1Hive Gardens v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the StreamingEscrow smart contract (StreamingEscrow.sol). The claim() function correctly checks the disputed flag and rejects withdrawals during disputes, but the public syncOutflow() function performs the same excess-balance transfer to the beneficiary without verifying the disputed status. An attacker can call the permissionless syncOutflow() function repeatedly to drain accumulated excess tokens to a beneficiary while a proposal is disputed. The vulnerability affects the dispute resolution workflow: after a streaming proposal is challenged, the dispute flag blocks new outflows but does not prevent accumulation; syncOutflow() then transfers this accumulated excess despite the active dispute. If the proposal is later rejected, drainToStrategy() cannot recover already-transferred tokens. The patch adds a disputed check before draining excess in syncOutflow().

Affected products

  • 1Hive Gardens v2 before 0xc9d4e0dacd937364793278180551e59d93cd43f9

Timeline

  • 2026-06-01: disclosed: GitHub Security Advisory GHSA-jxgc-cgfq-436j published
  • 2026-09-03: advisory: CVE-2026-53924 published on NVD
  • 2026-06-01: patched: Patched in commit 0xc9d4e0dacd937364793278180551e59d93cd43f9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.