CVE-2026-53924
Received Received - Intake

Unauthorized Token Transfer in Gardens v2 During Dispute

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim() correctly rejects withdrawals while an escrow is disputed, but the permissionless syncOutflow() path performs the same excess-balance transfer without checking disputed. After a streaming proposal is challenged, anyone can call syncOutflow() to transfer escrowed SuperTokens to the proposal beneficiary while the dispute is pending. If the proposal is later rejected, those tokens cannot be recovered by drainToStrategy(). This issue has been patched in 0xc9d4e0dacd937364793278180551e59d93cd43f9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-53924
EUVD
EUVD-2026-70524

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
1hive gardens to 0xc9d4e0dacd937364793278180551e59d93cd43f9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a high-severity vulnerability in the Gardens v2 smart contract system affecting the StreamingEscrow.sol contract. The issue is in the syncOutflow() function, which allows permissionless transfers of excess SuperTokens to a proposal beneficiary even when a streaming proposal is under dispute. Normally, the claim() function prevents withdrawals during disputes, but syncOutflow() bypasses this check, enabling unauthorized fund transfers.

Detection Guidance

To detect this vulnerability, review the Gardens v2 smart contract code for the StreamingEscrow.sol contract. Specifically, check if the syncOutflow() function calls _drainExcessToBeneficiary() without verifying the dispute status. If such a pattern exists, the contract is vulnerable.

Impact Analysis

An attacker could exploit this to drain excess funds from an escrow to a beneficiary while a dispute is pending. If the proposal is later rejected, those tokens cannot be recovered because they are no longer held in the escrow. This results in permanent loss of funds for the escrow holder.

Mitigation Strategies

Immediately update the StreamingEscrow.sol contract to version 0xc9d4e0dacd937364793278180551e59d93cd43f9 or later. Ensure the syncOutflow() function includes a dispute status check before calling _drainExcessToBeneficiary().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart