CryptoSlate
A Superfluid vulnerability on Celo let an attacker drain more than $107,000 from GoodDollar's UBI reserves, with 86,588 cUSD pulled from its Celo reserve and a further $20,857 from XDC after a malicious Super App bypassed liquidation safeguards. Superfluid's Security Council pinned the bug to its Celo deployment, traced the liquidation failure on Sept. 4 and deployed a hotfix within days. GoodDollar serves more than 963,000 daily claimants and has distributed 2.3 billion G$ through its universal basic income program, making the drained reserves a structural hit to the protocol's economic backbone.
Why it matters
GoodDollar's reserve is the funding engine behind its daily G$ distribution: stablecoins sit in DeFi strategies and the yield pays out universal basic income to registered wallets. An exploit that lets an attacker mint or borrow excess G$ against the reserve is not just a treasury loss, it is a direct attack on the mechanism that prints the daily claim. GoodDollar says reserves were not depleted thanks to monitoring alerts and emergency pauses, but reserve operations on both Celo and XDC remain frozen and bridging is suspended while the team works to clear the excess G$.
Market impact
Roughly 2.4 billion G$, about 28% of the 8.7 billion circulating supply, sits on Celo, second only to the 4.19 billion on Fuse and well ahead of the 1.82 billion on Ethereum and 292.5 million on XDC. GoodDollar has warned users against swapping G$ until external pool liquidity rebuilds, citing slippage risk in thin markets. The unresolved $20,857 XDC leg is the bigger signal: Superfluid's council says the underlying flaw only lived on Celo, yet G$ value flowed out of the XDC reserve, leaving a cross-chain accounting gap both projects say separate incident reports will close.
Frequently asked questions
-
What is GoodDollar and how big is its user base?
GoodDollar is a decentralized universal basic income protocol that distributes G$ tokens daily to registered users. Its dashboard shows more than 963,000 unique UBI claimants and 2.3 billion G$ distributed through the program.
-
How much was stolen from GoodDollar's reserves?
An attacker drained 86,588 cUSD from GoodDollar's Celo reserve and a further $20,857 from its XDC reserve, totaling more than $107,000. External G$ liquidity pools were also affected, though losses there remain undisclosed.
-
What was the Superfluid vulnerability?
A malicious Super App bypassed Superfluid's whitelisting requirement on Celo, leaving insolvent G$ balances active when they should have been liquidated. The attacker then exchanged those excess balances against assets in the GoodDollar reserve and other pools.
-
Is the GoodDollar daily UBI claim still working?
Claiming, G$ transfers and identity verification have resumed on Celo. Reserve operations on Celo and XDC remain paused, however, and bridging is suspended until the team clears the excess G$ and restores liquidity.
-
How did XDC reserves lose funds if the bug only existed on Celo?
Superfluid's Security Council says the underlying vulnerability was specific to its Celo deployment. Neither GoodDollar nor Superfluid has explained how the excess G$ reached the XDC network, and both teams say separate incident reports will close the gap.
WuBlockchain
TheBlock
CoinDesk
Crypto Rank News