Executive brief
Gardens v2 is a governance framework used for community decision-making through customizable voting pools. A vulnerability in its dispute resolution process allows beneficiaries to withdraw the entire escrow reserve for active streaming proposals when disputes are resolved in their favor, instead of preserving the portion that should remain locked for the active stream. This could enable unauthorized fund withdrawal that violates the intended escrow protection.
Technical details
The vulnerability exists in the approve-side dispute resolution path of StreamingEscrow. When a disputed streaming proposal is resolved as approved (or times out with defaultRuling == 1), CVDisputeFacet.rule() calls _handleStreamingResolution(..., true), which clears the disputed flag and then invokes drainToBeneficiary(). This function transfers the full escrow balance to the beneficiary, whereas normal payout paths (claim() and syncOutflow()) preserve the depositAmount() reserve needed for the active stream. The vulnerable code path in StreamingEscrow._drainTo() lacks the reserve-preserving logic present in _drainExcessToBeneficiary(). Attack preconditions require an active streaming proposal with an active dispute that resolves favorably to the beneficiary. The issue survives through the strategy-controlled CVDisputeFacet.rule() code path and was discovered through source code review with no exploit verification.
Affected products
- 1Hive Gardens v2 commit dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior
Timeline
- 2026-06-17: disclosed
- 2026-09-03: advisory