CVE-2026-57445 Details
Description
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount() while an active stream needs an escrow reserve. However, the approve-side dispute resolution path drains the whole available escrow balance to the proposal beneficiary. At time of publication, there are no publicly known patches.
A vulnerability exists in Gardens V2 smart contracts, specifically in the StreamingEscrow component, in versions through dfba919e218e20d52db9f7b2e8d292d45a46c91b. The issue arises during the approve-side dispute resolution process, where the entire available escrow balance is drained to the proposal beneficiary, instead of preserving the funds required for active streaming. This misallocation can disrupt the intended governance and funding mechanisms within the platform.
The dispute resolution process should be modified to only transfer funds above the required active-stream reserve to the beneficiary, ensuring that the necessary escrow buffer is maintained.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1Hive/gardens-v2/security/advisories/GHSA-3xpr-2mm7-77j7 | [email protected] | AdvisoryTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-703 | Improper Check or Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1Hive Gardens v2 | <= dfba919e218e20d52db9f7b2e8d292d45a46c91b |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |