The vulnerability arises in the Gardens v2 governance framework where the syncOutflow() function allows anyone to transfer escrowed tokens to a proposal beneficiary without verifying if a streaming proposal is in dispute. This bypasses the intended check in StreamingEscrow.claim() that blocks withdrawals while a dispute is pending. The result is that tokens can be moved out of escrow and potentially liquidated before a dispute decision is reached, leading to financial loss for the community and undermining the fairness of the governance process. The weakness is identified as an improper authorization check (CWE-284).

The affected product is 1Hive Gardens v2 before the commit 0xc9d4e0dacd937364793278180551e59d93cd43f9. Users deploying the older contract versions are vulnerable because the syncOutflow path remains unprotected against disputes. The patch address alters the function to include the same dispute check that claim() applies.

The CVSS score of 8.7 reflects a high severity of this flaw, indicating significant potential damage. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the flaw is exploitable via a normal smart‑contract call from any address. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit yet, though the nature of the bug makes it attractive for malicious actors. Attackers could trigger the flaw once a streaming proposal has been contested, moving tokens to the proposal beneficiary and preventing recovery if the proposal is eventually rejected.