EUVD-2026-70524Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
syncOutflow() is permissionless (PR:N), callable over the network (AV:N) with no special conditions once a dispute is on-chain; only integrity impact applies as transferred tokens are irrecoverable.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim() correctly rejects withdrawals while an escrow is disputed, but the permissionless syncOutflow() path performs the same excess-balance transfer without checking disputed. After a streaming proposal is challenged, anyone can call syncOutflow() to transfer escrowed SuperTokens to the proposal beneficiary while the dispute is pending. If the proposal is later rejected, those tokens cannot be recovered by drainToStrategy(). This issue has been patched in 0xc9d4e0dacd937364793278180551e59d93cd43f9.
AnalysisAI
Irrecoverable SuperToken drain in Gardens v2's StreamingEscrow contract allows any caller to invoke the permissionless syncOutflow() function during an active governance dispute, transferring escrowed funds to the proposal beneficiary before dispute resolution completes. Unlike StreamingEscrow.claim(), which correctly enforces a disputed-state gate, syncOutflow() performs the same excess-balance transfer without checking the disputed flag, creating an exploitable asymmetry in the contract's state machine. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) a Gardens v2 deployment running unpatched StreamingEscrow contracts compiled before commit 0xc9d4e0dacd937364793278180551e59d93cd43f9, (2) at least one active streaming proposal that has been challenged and entered a disputed state - creating the on-chain condition observable by any network participant, and (3) an attacker who calls syncOutflow() during the window between dispute initiation and final resolution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with AV:N/AC:L/PR:N/UI:N/VI:H accurately reflects the exploit profile: the attack requires no authentication, no special tooling, and no complex setup beyond identifying an on-chain disputed proposal - all of which is observable via public blockchain events. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available at commit 0xc9d4e0dacd937364793278180551e59d93cd43f9 in the 1Hive/gardens-v2 repository; affected communities must redeploy StreamingEscrow contracts compiled from this or a later commit - contract upgrades or redeployment are the only complete remediation since on-chain bytecode cannot be patched in place. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all instances of Gardens v2 StreamingEscrow deployments in use and immediately assess active governance disputes involving escrowed assets; pause new governance disputes if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gardens V2
View allImproper escrow accounting in Gardens v2's StreamingEscrow contract allows a proposal beneficiary to receive the full av
Unchecked escrow draining in 1Hive's Gardens v2 governance framework allows any low-privilege proposal submitter to siph
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today