A Superfluid bug let an attacker drain more than $100,000 from GoodDollar reserves by creating excess G$ on Celo.
GoodDollar said on Sept. 9 that 86,588 cUSD was exchanged out of its Celo reserve and another $20,857 from its XDC reserve after a malicious Super App bypassed Superfluid’s liquidation safeguards. External G$ liquidity pools were also affected, though neither project has disclosed the losses there.
GoodDollar is a decentralized universal basic income protocol that distributes G$ tokens daily to registered users. Its reserve is backed by stablecoins, with yield generated through DeFi investments used to support G$ issuance and UBI distributions.
GoodDollar’s dashboard shows more than 963,000 unique UBI claimants and 2.3 billion G$ distributed through the program, making the reserve central to the token’s economic model and the daily distribution system built around it.
Celo bug hit network holding 28% of G$ supply
About 2.4 billion G$ crypto tokens circulate on Celo, roughly 28% of the token’s 8.7 billion circulating supply and second only to the 4.19 billion on Fuse. Ethereum holds about 1.82 billion G$, while XDC accounts for 292.5 million.
Superfluid’s Security Council said the vulnerability was specific to its Celo deployment. A malicious application was able to bypass a whitelisting requirement and leave insolvent G$ balances active when they should have been liquidated. Those excess balances were then exchanged against assets in the GoodDollar Reserve and other liquidity pools.
Superfluid detected insolvent accounts on Sept. 3 and traced the liquidation failure to the Super App bug the following day. It deployed a hotfix, reinstated Super App whitelisting on Celo and closed the affected accounts. The council said other Superfluid networks were not exposed to the same flaw.
GoodDollar said its Celo and XDC reserves were not depleted, citing monitoring alerts, emergency pauses and existing protocol safeguards. Claiming, G$ transfers and identity verification have resumed on Celo.
Reserve operations on Celo and XDC remain paused, however, while bridging is suspended and liquidity in external pools remains limited. GoodDollar has advised users against swapping G$ until liquidity improves, warning that thin markets could produce significant slippage and prices that diverge from normal levels.
Meanwhile, the XDC loss remains unexplained. Superfluid said the underlying vulnerability existed only on Celo, yet GoodDollar reported another $20,857 exchanged out of its XDC reserve. Neither project has disclosed how the excess G$ reached or affected that network.
GoodDollar said it plans to address the excess G$, restore liquidity and reopen the remaining paused functions. GoodDollar and Superfluid are preparing separate incident reports that should provide a fuller accounting of external-pool losses and explain how the Celo exploit produced an outflow on XDC.
