A bug in Superfluid's Celo deployment enabled an attacker to create excess G$ tokens and withdraw over $100,000 from GoodDollar reserves, according to an announcement on September 9. The exploit extracted 86,588 cUSD from GoodDollar's Celo reserve and $20,857 from its XDC reserve.
GoodDollar is a decentralized universal basic income protocol that distributes G$ tokens daily to registered users. The protocol's reserve, backed by stablecoins, generates yield through DeFi investments to support token issuance and daily distributions. GoodDollar's dashboard shows more than 963,000 unique UBI claimants and 2.3 billion G$ distributed through the program.
How the Exploit Worked
A malicious Super App bypassed Superfluid's liquidation safeguards on Celo, leaving insolvent G$ balances active when they should have been liquidated. Those excess balances were then exchanged against assets in GoodDollar's reserve and other external liquidity pools. Superfluid's Security Council confirmed the vulnerability was specific to its Celo deployment and that other Superfluid networks were not exposed to the same flaw.
Superfluid detected insolvent accounts on September 3 and traced the liquidation failure to the Super App bug the following day. It deployed a hotfix, reinstated Super App whitelisting on Celo, and closed the affected accounts.
Current Status and Outstanding Questions
GoodDollar said its Celo and XDC reserves were not depleted, citing monitoring alerts and existing protocol safeguards. Claiming, G$ transfers, and identity verification have resumed on Celo. However, reserve operations on Celo and XDC remain paused, bridging is suspended, and liquidity in external pools remains limited. GoodDollar has advised users against swapping G$ until liquidity improves.
The $20,857 loss from the XDC reserve remains unexplained. Superfluid stated the underlying vulnerability existed only on Celo, yet GoodDollar reported an outflow on XDC. Neither project has disclosed how excess G$ reached that network or disclosed losses in external liquidity pools.
GoodDollar and Superfluid are preparing separate incident reports to provide a fuller accounting of external-pool losses and explain the XDC outflow.
Network Distribution
Approximately 2.4 billion G$ tokens circulate on Celo, representing roughly 28% of the token's 8.7 billion circulating supply. Fuse holds the largest amount at 4.19 billion G$, followed by Ethereum with 1.82 billion and XDC with 292.5 million.
