CVE-2026-55658

Name of the Vulnerable Software and Affected Versions Gardens v2 versions prior to 3e595f3

Description A flaw exists in the streaming proposal funding process where pool funds are moved into a StreamingEscrow to back a Superfluid constant flow agreement. When the cancelProposal() function is called, it zeroes the escrow's GDA member units but fails to reclaim the parked balance. Consequently, the permissionless claim() function allows the entire escrow balance, including the pool funded buffer, to be forwarded to the beneficiary, who is typically the proposal submitter. The only mechanism to return funds to the pool is the drainToStrategy() function, which is restricted to strategy permissions and only triggered by a dispute reject ruling, making it inaccessible during proposal cancellation or natural completion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.