GoodDollar, a cryptocurrency project that distributes a daily income to almost 1 million people, has suffered losses of more than $100,000 after a bug in Superfluid was exploited on the Celo network.
The project said on 9 September that 86,588 cUSD had been exchanged from its Celo reserve, while a further $20,857 was taken from its XDC reserve. The incident occurred after a malicious Super App bypassed Superfluid’s safeguards designed to liquidate insolvent positions.
External G$ liquidity pools were also affected, although GoodDollar and Superfluid have not yet disclosed the scale of those losses.
GoodDollar is a decentralised universal basic income protocol that gives registered users G$ tokens each day. Its reserve is backed by stablecoins, while returns generated through decentralised finance investments help fund the creation of G$ and the project’s income distributions.
The GoodDollar dashboard records more than 963,000 unique UBI claimants and says 2.3 billion G$ tokens have been distributed. The reserve is therefore central to both the token’s economic structure and the daily payments made through the scheme.
Celo network held 28% of G$ supply
Approximately 2.4 billion G$ tokens are circulating on Celo. That represents about 28% of the token’s total circulating supply of 8.7 billion, making Celo the second-largest network for G$ after Fuse, which holds 4.19 billion.
Ethereum accounts for about 1.82 billion G$, while XDC has 292.5 million.
Superfluid’s Security Council said the vulnerability was limited to its Celo deployment. A malicious application was able to evade a whitelisting requirement, allowing G$ balances that were insolvent to remain active instead of being liquidated.
Those artificially created balances were then exchanged for assets held in the GoodDollar Reserve and in other liquidity pools.
Superfluid found the insolvent accounts on 3 September and identified the liquidation failure as a Super App bug the following day. It subsequently released a hotfix, restored Super App whitelisting on Celo and closed the affected accounts.
The Security Council said other networks using Superfluid were not vulnerable to the same problem.
GoodDollar said its Celo and XDC reserves had not been emptied, pointing to monitoring alerts, emergency pauses and existing protocol safeguards. Claiming, transfers and identity verification have resumed on Celo.
However, reserve activity on both Celo and XDC remains paused. Bridging has also been suspended, while liquidity in external pools is limited. GoodDollar has told users not to swap G$ until liquidity improves, warning that thin markets may cause significant slippage and prices to move away from normal levels.
The loss on XDC has not been explained. Superfluid said the underlying vulnerability existed only on Celo, but GoodDollar reported that $20,857 had been exchanged from its XDC reserve. Neither organisation has said how the excess G$ reached or affected that network.
GoodDollar plans to deal with the excess G$, rebuild liquidity and restore the remaining paused functions. GoodDollar and Superfluid are preparing separate incident reports, which are expected to provide a fuller account of losses from external pools and explain how the Celo exploit led to an outflow involving XDC.
