# CVE-2026-55658: 1Hive Gardens v2 fund drainage in streaming escrow on proposal cancellation

Source: https://junglewise.ai/threats/cve-2026-55658-1hive-gardens-v2-fund-drainage-in-streaming-escrow-on-proposal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55658 · Severity: high · CVSS 7.7 · Published 2026-09-03

Gardens v2 is a blockchain-based governance framework that manages community funding pools for proposals using streaming payments. When a proposal is cancelled, pool funds held in escrow accounts become accessible to attackers who can claim them as the proposal beneficiary, bypassing normal fund security controls and permanently draining governance funds.

Technologies: [1Hive Gardens v2](https://junglewise.ai/threats/technologies/gardens-v2). Vendors: [1Hive](https://junglewise.ai/threats/vendors/1hive).

## Quick answers

**Is CVE-2026-55658 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55658 being exploited in the wild.

**How severe is CVE-2026-55658?** High severity, with a CVSS score of 7.7, published 3 September 2026.

**Which products and versions are affected?** 1Hive Gardens v2 commit 3e595f3 and prior (no release tags).

**Is there a fix for CVE-2026-55658?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55658 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55658?** Check whether you run 1Hive Gardens v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the StreamingEscrow contract's fund recovery logic. When a streaming proposal is funded, pool SuperTokens are deposited into an escrow to back a Superfluid constant flow agreement. On proposal cancellation, CVProposalFacet.cancelProposal() zeroes the escrow's GDA member units but fails to drain the residual balance back to the strategy. Subsequently, the permissionless claim() function computes available balance minus depositAmount(), but since depositAmount() returns zero for a zero-flow escrow, claim() transfers the entire parked balance—including pool-funded buffer—to the proposal beneficiary. The beneficiary is attacker-controlled (chosen by proposal submitter, defaulting to submitter). The only path returning escrow funds is drainToStrategy(), which is gated to strategy-only and only reachable via dispute reject ruling, never on cancel or natural completion. An attacker can create a streaming proposal, self-stake to reach threshold, await rebalance() to fund the escrow, cancel the proposal, and call claim() to drain the full buffer.

## Affected products

- 1Hive Gardens v2 commit 3e595f3 and prior (no release tags)

## Timeline

- 2026-06-14: disclosed: GHSA-jwvq-5xmf-f377 published by 1Hive on GitHub Security Advisory
- 2026-09-03: advisory: CVE-2026-55658 published
- 2026-09-03: other: No publicly known patches available at time of publication

## References

- [https://github.com/1Hive/gardens-v2/security/advisories/GHSA-jwvq-5xmf-f377](https://github.com/1Hive/gardens-v2/security/advisories/GHSA-jwvq-5xmf-f377)

## Related threats

- [Gardens v2 escrow drainage in dispute resolution](https://junglewise.ai/threats/cve-2026-57445-gardens-v2-escrow-drainage-in-dispute-resolution)
- [1Hive Gardens v2 unauthorized fund transfer in StreamingEscrow](https://junglewise.ai/threats/cve-2026-53924-1hive-gardens-v2-unauthorized-fund-transfer-in-streamingescrow)