GoodDollar reserves drained after Superfluid bug

On Sept. 9 GoodDollar reported that a vulnerability in Superfluid’s Celo deployment allowed a malicious Super App to create excess G$ tokens and exchange assets from the project’s reserves. The attacker swapped 86,588 cUSD from the Celo reserve and $20,857 from the XDC reserve, a combined outflow of more than $100,000.

GoodDollar traced the issue to a Super App that bypassed Superfluid’s whitelisting requirement and left insolvent G$ balances active when they should have been liquidated. Superfluid’s Security Council detected insolvent accounts on Sept. 3, identified the Super App bug on Sept. 4 and deployed a hotfix on Celo. The council reported that other Superfluid networks were not affected by the same vulnerability.

The exploit drained assets from GoodDollar’s on-chain reserves and affected external G$ liquidity pools. GoodDollar halted reserve operations and bridged transfers on Celo and XDC while teams work to remove the excess supply and rebuild liquidity. Claiming, G$ transfers and identity verification on Celo have been resumed, but the project advised against swapping G$ because thin markets could produce significant slippage and abnormal prices.

Superfluid reinstated Super App whitelisting on Celo and closed the affected accounts. The XDC outflow of $20,857 remains unexplained; Superfluid maintains the vulnerability was specific to Celo, and GoodDollar has not disclosed how excess G$ reached or impacted XDC liquidity pools.

GoodDollar’s reserve supports its daily universal basic income program, which has distributed about 2.3 billion G$ to more than 963,000 unique claimants. Approximately 2.4 billion G$ circulate on Celo, about 28% of the token’s 8.7 billion circulating supply. Other balances sit on Fuse, Ethereum and XDC.

The protocol said monitoring alerts, emergency pauses and existing safeguards prevented full depletion of the Celo and XDC reserves. GoodDollar and Superfluid are preparing incident reports that will detail losses in external pools and explain the XDC outflow.

Teams from both projects said they will remove excess G$ from circulation, restore liquidity to affected pools and reopen paused functions once forensic work is complete and it is safe to proceed.