CVE-2026-53924

Gardens v2, a modular DAO governance framework that manages governance pools with streaming payouts, contains a state-check gap in its StreamingEscrow contract: the claim() function correctly blocks withdrawals while an escrow is disputed, but the permissionless syncOutflow() path performs the same excess-balance transfer without any dispute check. After a streaming proposal is challenged, any unprivileged on-chain actor can call syncOutflow() to move escrowed SuperTokens to the proposal beneficiary while the dispute is still pending. If the disputed proposal is later rejected, those transferred tokens cannot be recovered through drainToStrategy(), permanently reducing the pool's escrowed funds. Affected parties are Gardens v2 deployments whose contracts predate the fix commit, since the attack requires no privileges, authentication, or user interaction. No exploitation, public proof-of-concept, or KEV listing is known; EPSS puts 30-day exploitation probability at roughly 0.2%.

What to do: Update Gardens v2 contracts to include commit 0xc9d4e0dacd937364793278180551e59d93cd43f9 or later, which may require contract redeployment or migration for already-deployed pools. In the meantime, administrators of pools with pending disputed streaming proposals should monitor StreamingEscrow for syncOutflow() calls during disputes, since funds moved this way are unrecoverable if the proposal is rejected.