Security Exploit Hits GoodDollar Reserves Following Superfluid Protocol Bug

The GoodDollar protocol, a decentralized initiative providing universal basic income (UBI), recently suffered a security breach that resulted in the loss of over $100,000 from its reserves. A vulnerability within the Superfluid protocol’s Celo deployment allowed an attacker to bypass critical liquidation safeguards, enabling the creation of excess G$ tokens that were subsequently used to drain assets from the project’s financial backing.

The Mechanics of the Breach

The exploit was triggered by a malicious "Super App" that successfully bypassed Superfluid’s whitelisting requirements. This bypass allowed insolvent G$ balances to remain active when they should have been liquidated, effectively creating unbacked tokens. The attacker then exchanged these excess tokens against GoodDollar’s reserves, draining approximately $86,588 from the Celo reserve and $20,857 from the XDC reserve. While Superfluid confirmed that the underlying vulnerability was specific to its Celo deployment, the teams are still investigating how the exploit led to an outflow on the XDC network.

Mitigation and System Recovery

In response to the incident, Superfluid deployed a hotfix to reinstate whitelisting and close affected accounts, confirming that other networks were not exposed to the same flaw. GoodDollar has since resumed G$ transfers and identity verification on Celo, though reserve operations and bridging remain suspended to protect the remaining assets. The protocol has advised users to avoid swapping G$ tokens for the time being, as thin liquidity in external pools could lead to significant slippage and price volatility. Moving forward, both GoodDollar and Superfluid are preparing detailed incident reports to account for all losses and outline a plan to restore the UBI ecosystem's liquidity.