Gardens V2
Monthly
Irrecoverable SuperToken drain in Gardens v2's StreamingEscrow contract allows any caller to invoke the permissionless syncOutflow() function during an active governance dispute, transferring escrowed funds to the proposal beneficiary before dispute resolution completes. Unlike StreamingEscrow.claim(), which correctly enforces a disputed-state gate, syncOutflow() performs the same excess-balance transfer without checking the disputed flag, creating an exploitable asymmetry in the contract's state machine. If the dispute is subsequently resolved against the proposal, drainToStrategy() cannot recover the already-transferred tokens, resulting in permanent loss of community treasury assets with no on-chain recovery path.
Improper escrow accounting in Gardens v2's StreamingEscrow contract allows a proposal beneficiary to receive the full available escrow balance when an approve-side dispute is resolved in their favour, rather than the correct depositAmount() entitlement. Affected commit is dfba919e218e20d52db9f7b2e8d292d45a46c91b and all prior revisions. No patch has been released at time of publication. No public exploit or CISA KEV listing has been identified, but the logic flaw is described in a public GitHub Security Advisory (GHSA-3xpr-2mm7-77j7), lowering the bar for exploitation by anyone familiar with the codebase.
Unchecked escrow draining in 1Hive's Gardens v2 governance framework allows any low-privilege proposal submitter to siphon pool-funded buffer balances by exploiting a cancel-then-claim flow. Versions at commit 3e595f3 and prior are affected: when a streaming proposal is cancelled, cancelProposal zeroes the GDA member units but never reclaims the CFA deposit and 0.5% margin buffer parked in the StreamingEscrow, while the permissionless claim() function then forwards that entire orphaned balance to the attacker-chosen beneficiary. No patch is available as of publication, and the only on-chain fund-recovery path (drainToStrategy) is gated to dispute rejection rulings and cannot be invoked on normal cancellation or completion.
Irrecoverable SuperToken drain in Gardens v2's StreamingEscrow contract allows any caller to invoke the permissionless syncOutflow() function during an active governance dispute, transferring escrowed funds to the proposal beneficiary before dispute resolution completes. Unlike StreamingEscrow.claim(), which correctly enforces a disputed-state gate, syncOutflow() performs the same excess-balance transfer without checking the disputed flag, creating an exploitable asymmetry in the contract's state machine. If the dispute is subsequently resolved against the proposal, drainToStrategy() cannot recover the already-transferred tokens, resulting in permanent loss of community treasury assets with no on-chain recovery path.
Improper escrow accounting in Gardens v2's StreamingEscrow contract allows a proposal beneficiary to receive the full available escrow balance when an approve-side dispute is resolved in their favour, rather than the correct depositAmount() entitlement. Affected commit is dfba919e218e20d52db9f7b2e8d292d45a46c91b and all prior revisions. No patch has been released at time of publication. No public exploit or CISA KEV listing has been identified, but the logic flaw is described in a public GitHub Security Advisory (GHSA-3xpr-2mm7-77j7), lowering the bar for exploitation by anyone familiar with the codebase.
Unchecked escrow draining in 1Hive's Gardens v2 governance framework allows any low-privilege proposal submitter to siphon pool-funded buffer balances by exploiting a cancel-then-claim flow. Versions at commit 3e595f3 and prior are affected: when a streaming proposal is cancelled, cancelProposal zeroes the GDA member units but never reclaims the CFA deposit and 0.5% margin buffer parked in the StreamingEscrow, while the permissionless claim() function then forwards that entire orphaned balance to the attacker-chosen beneficiary. No patch is available as of publication, and the only on-chain fund-recovery path (drainToStrategy) is gated to dispute rejection rulings and cannot be invoked on normal cancellation or completion.