CVE-2026-53924: Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim() correctly rejects withdrawals while an escrow is disputed, but the permissionless syncOutflow() path performs the same excess-balance transfer without checking disputed. After a streaming proposal is challenged, anyone can call syncOutflow() to transfer escrowed SuperTokens to the proposal beneficiary while the dispute is pending. If the proposal is later rejected, those tokens cannot be recovered by drainToStrategy(). This issue has been patched in 0xc9d4e0dacd937364793278180551e59d93cd43f9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
StreamingEscrow (syncOutflow permissionless path)to a version that resolves this vulnerability.Fixed in 0xc9d4e0dacd937364793278180551e59d93cd43f9
Event History
Frequently Asked Questions
Which deployments are affected?
Gardens v2 deployments using code prior to commit 0xc9d4e0dacd937364793278180551e59d93cd43f9 are affected. The issue is in the StreamingEscrow syncOutflow() path.
What does an attacker need to do to exploit this?
A streaming proposal must first be challenged so that its escrow is disputed. Any party can then call the permissionless syncOutflow() function to send the escrow's SuperTokens to the proposal beneficiary while the dispute remains pending.
What is the consequence if the disputed proposal is ultimately rejected?
Tokens transferred through syncOutflow() cannot be recovered by drainToStrategy() after rejection. This can cause escrowed SuperTokens to remain with the proposal beneficiary despite the proposal being rejected.
What should operators do if they identify an affected deployment?
Update to the patch at commit 0xc9d4e0dacd937364793278180551e59d93cd43f9. Until patched, disputed streaming proposals are exposed to permissionless syncOutflow() calls.