Read the docs
TI-2026-38895 Aliases CVE-2026-53924

Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes

Priority HIGH 77CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim() correctly rejects withdrawals while an escrow is disputed, but the permissionless syncOutflow() path performs the same excess-balance transfer without checking disputed. After a streaming proposal is challenged, anyone can call syncOutflow() to transfer escrowed SuperTokens to the proposal beneficiary while the dispute is pending. If the proposal is later rejected, those tokens cannot be recovered by drainToStrategy(). This issue has been patched in 0xc9d4e0dacd937364793278180551e59d93cd43f9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix Fixed gardens-v2 (1Hive): 0xc9d4e0dacd937364793278180551e59d93cd43f9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Hivegardens-v2before 0xc9d4e0dacd937364793278180551e59d93cd43f90xc9d4e0dacd937364793278180551e59d93cd43f9Patch availableCNA
  • gardens-v2 Vendor1Hive Affected before 0xc9d4e0dacd937364793278180551e59d93cd43f9 Fixed in 0xc9d4e0dacd937364793278180551e59d93cd43f9 Patch available CNA

Remediation

  • Fix · CNA gardens-v2 (1Hive) Fixed in 0xc9d4e0dacd937364793278180551e59d93cd43f9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53924

References

Other 1

  • TI-2026-40181 Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim() CVSS 3.1HIGH 7.7
  • TI-2026-41381 Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences