CVE-2026-55658
nicheMissing authorization in Gardens v2 escrow lets claim() divert pool-backed funds
Gardens v2 (through commit 3e595f3), a modular on-chain governance framework for community governance pools, mishandles funds parked in StreamingEscrow contracts when streaming proposals are cancelled or end naturally. When a streaming proposal is funded, the streaming contracts move real pool funds into the escrow to back the Superfluid constant flow agreement (CFA deposit plus a 0.5% margin), but cancelProposal only zeroes the escrow's GDA member units and never reclaims that parked balance, after which the permissionless claim() function forwards the escrow's entire balance - including the pool-funded buffer - to a beneficiary chosen by the proposal submitter and defaulting to the submitter. The only path that returns escrow funds to the pool, drainToStrategy, is restricted to the strategy and reachable solely via a dispute 'reject' ruling, so on cancel or natural completion, pool funds that should return to the pool are instead paid out to the beneficiary. Communities or DAOs running Gardens v2 governance pools with streaming proposals are affected; the impact is diversion or misappropriation of pool funds (integrity, not confidentiality), matching the high-severity, scope-changed CVSS score of 7.7. There are no publicly known patches, no public proof-of-concept, no entry in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days.
What to do: Because no patch is available yet, communities operating Gardens v2 pools should pause funding of new streaming proposals where possible and treat escrowed balances from cancelled or completed streaming proposals as at risk of diversion; note that recovery to the pool is currently possible only via the strategy-gated drainToStrategy path reached through a dispute 'reject' ruling, and, where supported, set the beneficiary to the pool or treasury rather than the submitter. Watch the Gardens repository for a patched release from the maintainers (CNA: GitHub) and deploy the fixed contracts as soon as one is published. Audit existing StreamingEscrow balances and reconcile any funds already claimed out to beneficiaries against expected pool accounting.
| Gardens (open-source project; advisory assigned by GitHub CNA security-advisorie Gardens v2 governance framework (streaming proposal / StreamingEscrow contracts) | commit 3e595f3 and all prior commits; no fixed version or patch publicly known at time of publication |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches.
- Weakness
- CWE-862
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
In the news0 stories
No ingested article mentions this CVE yet.