A crypto project paying nearly 1 million people a daily income just had its reserves looted

A Superfluid bug let an attacker drain more than $100,000 from GoodDollar reserves by creating excess G$ on Celo.

GoodDollar said on Sept. 9 that 86,588 cUSD was exchanged out of its Celo reserve and another $20,857 from its XDC reserve after a malicious Super App bypassed Superfluid’s liquidation safeguards. External G$ liquidity pools were also affected, though neither project has disclosed the losses there.

GoodDollar is a decentralized universal basic income protocol that distributes G$ tokens daily to registered users. Its reserve is backed by stablecoins, with yield generated through DeFi investments used to support G$ issuance and UBI distributions.

GoodDollar’s dashboard shows more than 963,000 unique UBI claimants and 2.3 billion G$ distributed through the program, making the reserve central to the token’s economic model and the daily distribution system built around it.

Celo bug hit network holding 28% of G$ supply

About 2.4 billion G$ crypto tokens circulate on Celo, roughly 28% of the token’s 8.7 billion circulating supply and second only to the 4.19 billion on Fuse. Ethereum holds about 1.82 billion G$, while XDC accounts for 292.5 million.

Superfluid’s Security Council said the vulnerability was specific to its Celo deployment. A malicious application was able to bypass a whitelisting requirement and leave insolvent G$ balances active when they should have been liquidated. Those excess balances were then exchanged against assets in the GoodDollar Reserve and other liquidity pools.