An attacker used a bug in Superfluid's Celo deployment to create excess G$ tokens and drain more than $100,000 from GoodDollar's reserves. The project, which pays a daily basic income to nearly a million registered claimants, has paused reserve operations and bridging while it investigates an unexplained loss on a second network.
A Superfluid bug let an attacker drain more than $100,000 from GoodDollar reserves by creating excess G$ on Celo. GoodDollar said on Sept. 9 that a malicious Super App bypassed Superfluid's liquidation safeguards. It reported 86,588 cUSD exchanged out of its Celo reserve. It reported another $20,857 from its XDC reserve as well. External G$ liquidity pools were also affected, though neither project has disclosed the losses there.
A UBI program with nearly a million claimants
GoodDollar is a decentralized universal basic income protocol that distributes G$ tokens daily to registered users. Its reserve is backed by stablecoins, with yield generated through DeFi investments used to support G$ issuance and UBI distributions. GoodDollar's dashboard shows more than 963,000 unique UBI claimants. The program has distributed 2.3 billion G$ so far.
Celo bug hit a network holding 28% of G$ supply
About 2.4 billion G$ tokens circulate on Celo, roughly 28% of the token's 8.7 billion circulating supply and second only to the 4.19 billion on Fuse. Ethereum holds about 1.82 billion G$, while XDC accounts for 292.5 million. Superfluid's Security Council said the vulnerability was specific to its Celo deployment: a malicious application bypassed a whitelisting requirement and left insolvent G$ balances active instead of liquidating them, then those excess balances were exchanged against assets in the GoodDollar Reserve and other liquidity pools.
Superfluid detected the insolvent accounts on Sept. 3 and traced the failure to the Super App bug the next day. It deployed a hotfix, reinstated Super App whitelisting on Celo and closed the affected accounts. The council said other Superfluid networks were not exposed to the same flaw.
Reserves hold, but the XDC loss stays unexplained
GoodDollar said its Celo and XDC reserves were not depleted, citing monitoring alerts, emergency pauses and existing protocol safeguards, and claiming, G$ transfers and identity verification have resumed on Celo. Reserve operations on Celo and XDC remain paused, however, while bridging stays suspended and liquidity in external pools remains limited. GoodDollar has advised users against swapping G$ until liquidity improves, warning that thin markets could produce significant slippage and prices that diverge from normal levels.
The XDC loss remains unexplained. Superfluid said the underlying vulnerability existed only on Celo, yet GoodDollar reported the separate $20,857 exchanged out of its XDC reserve, and neither project has disclosed how the excess G$ reached that network. GoodDollar said it plans to address the excess G$, restore liquidity and reopen the remaining paused functions.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
