Executive brief
Gardens v2 is a blockchain-based governance framework that manages community funding pools for proposals using streaming payments. When a proposal is cancelled, pool funds held in escrow accounts become accessible to attackers who can claim them as the proposal beneficiary, bypassing normal fund security controls and permanently draining governance funds.
Technical details
The vulnerability exists in the StreamingEscrow contract's fund recovery logic. When a streaming proposal is funded, pool SuperTokens are deposited into an escrow to back a Superfluid constant flow agreement. On proposal cancellation, CVProposalFacet.cancelProposal() zeroes the escrow's GDA member units but fails to drain the residual balance back to the strategy. Subsequently, the permissionless claim() function computes available balance minus depositAmount(), but since depositAmount() returns zero for a zero-flow escrow, claim() transfers the entire parked balance—including pool-funded buffer—to the proposal beneficiary. The beneficiary is attacker-controlled (chosen by proposal submitter, defaulting to submitter). The only path returning escrow funds is drainToStrategy(), which is gated to strategy-only and only reachable via dispute reject ruling, never on cancel or natural completion. An attacker can create a streaming proposal, self-stake to reach threshold, await rebalance() to fund the escrow, cancel the proposal, and call claim() to drain the full buffer.
Affected products
- 1Hive Gardens v2 commit 3e595f3 and prior (no release tags)
Timeline
- 2026-06-14: disclosed: GHSA-jwvq-5xmf-f377 published by 1Hive on GitHub Security Advisory
- 2026-09-03: advisory: CVE-2026-55658 published
- 2026-09-03: other: No publicly known patches available at time of publication