EUVD-2026-70523Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires prior participation as a proposal beneficiary (PR:L) and specific dispute resolution state (AC:H); no confidentiality or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount() while an active stream needs an escrow reserve. However, the approve-side dispute resolution path drains the whole available escrow balance to the proposal beneficiary. At time of publication, there are no publicly known patches.
AnalysisAI
Improper escrow accounting in Gardens v2's StreamingEscrow contract allows a proposal beneficiary to receive the full available escrow balance when an approve-side dispute is resolved in their favour, rather than the correct depositAmount() entitlement. Affected commit is dfba919e218e20d52db9f7b2e8d292d45a46c91b and all prior revisions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the following specific conditions to all be true: (1) a Gardens v2 governance pool must be deployed using the StreamingEscrow contract at or before commit dfba919e218e20d52db9f7b2e8d292d45a46c91b; (2) an active streaming proposal with an open escrow reserve must exist; (3) a dispute against that proposal must be raised and subsequently resolved via the approve-side path - meaning the dispute outcome favours the beneficiary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) reflects high integrity impact with no special prerequisites or complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all active proposals and escrow positions deployed on Gardens v2 (all commits prior to dfba919e218e20d52db9f7b2e8d292d45a46c91b are affected) to quantify at-risk capital; contact the Gardens development team to confirm patch availability and timeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gardens V2
View allIrrecoverable SuperToken drain in Gardens v2's StreamingEscrow contract allows any caller to invoke the permissionless s
Unchecked escrow draining in 1Hive's Gardens v2 governance framework allows any low-privilege proposal submitter to siph
Share
External POC / Exploit Code
Leaving vuln.today