CVE-2026-57445

CVE-2026-57445 is an incorrect fund-accounting flaw in the StreamingEscrow contract of Gardens v2, a modular on-chain governance framework used to run governance pools with custom voting. In commit dfba919e218e20d52db9f7b2e8d292d45a46c91b and all prior code, normal beneficiary payout paths correctly preserve depositAmount() so that active streams retain a required escrow reserve, but the approve-side dispute resolution path instead drains the entire available escrow balance to the proposal beneficiary. By triggering or steering a dispute resolution to the approve outcome, an attacker or an honest dispute process can cause the beneficiary to be overpaid, depleting escrow funds that should stay reserved for active streams (integrity impact, consistent with the CVSS 4.0 vector's high integrity/none confidentiality rating). Communities and DAOs operating Gardens v2 deployments built from the affected commit or earlier are affected, and at publication there are no publicly known patches. Exploitation status: no public proof-of-concept, no CISA KEV listing, and a low EPSS probability of 0.3% within 30 days.

What to do: Determine whether your Gardens v2 deployment is built from commit dfba919e218e20d52db9f7b2e8d292d45a46c91b or earlier, and track the upstream repository for a patched release since none is publicly available. In the meantime, review any pending disputes in your governance pools before approving-side resolution, since approving a proposal will drain the full available escrow balance and may strand funds needed as reserves for active streams; consider pausing escrow or dispute operations if the framework supports it.