CVE-2026-55658
Received Received - Intake

Funds Misappropriation in Gardens v2 Governance Framework

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-55658
EUVD
EUVD-2026-70522

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
1hive gardens-v2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gardens v2 allows a proposal submitter to drain pool funds by exploiting the StreamingEscrow contract. When a streaming proposal is funded, pool funds are moved into the escrow to support a Superfluid agreement. The cancelProposal function fails to reclaim parked funds, and the claim function then transfers the entire escrow balance—including pool funds—to the beneficiary, who is often the submitter. Funds can only be returned via drainToStrategy, which is restricted and rarely triggered.

Detection Guidance

Detecting this vulnerability requires reviewing the StreamingEscrow contract for improper fund handling after proposal cancellation. Check for unclaimed balances in StreamingEscrow after cancelProposal is called. Verify if claim() transfers pool-funded buffers to unintended beneficiaries. Audit logs for unauthorized fund movements to addresses not tied to dispute resolutions.

Impact Analysis

If you use Gardens v2, an attacker could exploit this to drain funds from your governance pool. The vulnerability allows unauthorized transfers of pool funds to a beneficiary of their choice, potentially causing financial loss. The attack requires low complexity and no special privileges, making it accessible to malicious actors.

Compliance Impact

This vulnerability could lead to non-compliance with financial and data protection regulations like GDPR or HIPAA by enabling unauthorized fund transfers. Loss of funds may violate financial integrity requirements, while improper handling of pooled assets could breach regulatory standards for governance and transparency.

Mitigation Strategies

Immediately review and update the cancelProposal function to reclaim parked balances via drainToStrategy. Restrict claim() to prevent transfers of post-cancellation residue. Monitor StreamingEscrow contracts for unauthorized fund withdrawals. Consider pausing streaming proposals until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart