GoodDollar reserves drained after Superfluid bug on Celo

GoodDollar, a decentralized universal basic income protocol that distributes G$ tokens daily to nearly one million users, suffered a significant reserve loss after a Superfluid bug on the Celo network was exploited.

How the exploit occurred

The vulnerability was specific to Superfluid’s Celo deployment. A malicious Super App bypassed a required whitelisting step, allowing insolvent G$ balances to remain active instead of being liquidated. The excess G$ was then exchanged against assets held in GoodDollar’s reserves and external liquidity pools.

Reserve losses

GoodDollar reported that 86,588 cUSD was exchanged out of its Celo reserve and an additional $20,857 was taken from its XDC reserve. The total outflow exceeds $100,000. External G$ liquidity pools were also impacted, though the exact losses there have not been disclosed.

Network exposure

Approximately 2.4 billion G$ tokens circulate on Celo, representing about 28 % of the token’s total supply of 8.7 billion. The remaining supply is split between Fuse (4.19 billion), Ethereum (1.82 billion) and XDC (292.5 million).

Response and current status

• Superfluid detected the insolvent accounts on September 3 and deployed a hotfix on September 4, reinstating Super App whitelisting on Celo and closing the affected accounts.
• GoodDollar confirmed that its Celo and XDC reserves were not fully depleted, citing monitoring alerts, emergency pauses, and protocol safeguards.
• G$ transfers, claiming and identity verification have resumed on Celo, but reserve operations on Celo and XDC remain paused, bridging is suspended, and external pool liquidity is limited.
• GoodDollar advises users to avoid swapping G$ until liquidity improves, warning of potential slippage and price divergence.

Next steps

GoodDollar and Superfluid are preparing separate incident reports to detail external‑pool losses and explain how the Celo exploit led to the outflow on XDC. The projects plan to address the excess G$, restore liquidity, and reopen the paused functions.