EUVD-2026-70522Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
PR:L for required proposal-submitter role; S:C for pool-wide fund impact; A:L added because repeated drain degrades pool reserve availability beyond pure integrity loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches.
AnalysisAI
Unchecked escrow draining in 1Hive's Gardens v2 governance framework allows any low-privilege proposal submitter to siphon pool-funded buffer balances by exploiting a cancel-then-claim flow. Versions at commit 3e595f3 and prior are affected: when a streaming proposal is cancelled, cancelProposal zeroes the GDA member units but never reclaims the CFA deposit and 0.5% margin buffer parked in the StreamingEscrow, while the permissionless claim() function then forwards that entire orphaned balance to the attacker-chosen beneficiary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold proposal-submission rights within the targeted Gardens v2 governance pool (PR:L - a standard low-privilege community participant role). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) reflects a realistic and straightforward exploitation path requiring only proposal-submitter privileges and no special conditions beyond a funded streaming proposal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the advisory at https://github.com/1Hive/gardens-v2/security/advisories/GHSA-jwvq-5xmf-f377 should be monitored for patch releases targeting the cancelProposal/claim() authorization gap. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all 1Hive Gardens v2 deployments and review current proposal submission access controls, audit escrow balances and historical proposals for suspicious claim transactions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gardens V2
View allImproper escrow accounting in Gardens v2's StreamingEscrow contract allows a proposal beneficiary to receive the full av
Irrecoverable SuperToken drain in Gardens v2's StreamingEscrow contract allows any caller to invoke the permissionless s
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today