CVE-2026-57445: Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount() while an active stream needs an escrow reserve. However, the approve-side dispute resolution path drains the whole available escrow balance to the proposal beneficiary. At time of publication, there are no publicly known patches.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to loss of escrow reserves?
Gardens v2 deployments at commit dfba919e218e20d52db9f7b2e8d292d45a46c91b or earlier are affected where StreamingEscrow has an active stream that requires an escrow reserve and a dispute can be resolved on the approve side.
What condition leads to the reserve being paid out?
The affected condition is use of the approve-side dispute-resolution path. Unlike normal beneficiary payout paths, that path can transfer the full available escrow balance to the proposal beneficiary rather than preserving the amount required by the active stream.
Is a patch available?
At the time of publication, no publicly known patches were available. The provided information does not identify a fixed commit or release.