The vulnerability is a logical flaw in the Gardens v2 governance framework that enables the entire escrowed balance to be transferred to the proposal beneficiary upon proposal cancellation. When a streaming proposal is funded, the pool’s real funds are moved into a StreamingEscrow, but the cancelProposal function zeroes the escrow units while leaving the buffer balance untouched. The exposed claim() function then forwards whatever remains in escrow to the beneficiary, who defaults to the proposal submitter. This flaw permits a submitter to withdraw pool funds they are not entitled to, resulting in loss of community assets. The weakness is classified as CWE‑862.

The issue affects the 1Hive Gardens v2 governance framework. It is present in code revisions up to and including commit 3e595f3 and earlier. No specific minor release is cited, so any deployment of Gardens v2 that has not applied a patch since that commit is potentially vulnerable.

The CVSS base score is 7.7, indicating moderate to high severity. No EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires the ability to submit or cancel a proposal; the permissionless claim() function can then be called by any address to receive the drained escrow balance. Because the flaw involves economic logic rather than a technical vulnerability, an attacker only needs to control a proposal submitter account to exploit it. Consequently, the risk remains moderate to high for communities using Gardens v2 without a vendor fix or additional controls.