cryptoslate.com
A Superfluid bug let an attacker drain more than $100,000 from GoodDollar reserves by creating excess G$ on Celo.
GoodDollar said on Sept. 9 that 86,588 cUSD was exchanged out of its Celo reserve and another $20,857 from its $XDC reserve after a malicious Super App bypassed Superfluid’s liquidation safeguards. External G$ liquidity pools were also affected, though neither project has disclosed the losses there.
GoodDollar is a decentralized universal basic income protocol that distributes G$ tokens daily to registered users. Its reserve is backed by stablecoins, with yield generated through DeFi investments used to support G$ issuance and UBI distributions.
GoodDollar’s dashboard shows more than 963,000 unique UBI claimants and 2.3 billion G$ distributed through the program, making the reserve central to the token’s economic model and the daily distribution system built around it.
Celo bug hit network holding 28% of G$ supply
About 2.4 billion G$ crypto tokens circulate on Celo, roughly 28% of the token’s 8.7 billion circulating supply and second only to the 4.19 billion on Fuse. Ethereum holds about 1.82 billion G$, while $XDC accounts for 292.5 million.
Superfluid’s Security Council said the vulnerability was specific to its Celo deployment. A malicious application was able to bypass a whitelisting requirement and leave insolvent G$ balances active when they should have been liquidated. Those excess balances were then exchanged against assets in the GoodDollar Reserve and other liquidity pools.
Superfluid detected insolvent accounts on Sept. 3 and traced the liquidation failure to the Super App bug the following day. It deployed a hotfix, reinstated Super App whitelisting on Celo and closed the affected accounts. The council said other Superfluid networks were not exposed to the same flaw.
GoodDollar said its Celo and $XDC reserves were not depleted, citing monitoring alerts, emergency pauses and existing protocol safeguards. Claiming, G$ transfers and identity verification have resumed on Celo.
Reserve operations on Celo and $XDC remain paused, however, while bridging is suspended and liquidity in external pools remains limited. GoodDollar has advised users against swapping G$ until liquidity improves, warning that thin markets could produce significant slippage and prices that diverge from normal levels.
Meanwhile, the $XDC loss remains unexplained. Superfluid said the underlying vulnerability existed only on Celo, yet GoodDollar reported another $20,857 exchanged out of its $XDC reserve. Neither project has disclosed how the excess G$ reached or affected that network.
GoodDollar said it plans to address the excess G$, restore liquidity and reopen the remaining paused functions. GoodDollar and Superfluid are preparing separate incident reports that should provide a fuller accounting of external-pool losses and explain how the Celo exploit produced an outflow on $XDC.