GoodDollar Reserves Lose Over $100K Through Superfluid Bug

An attacker drained more than $100,000 from GoodDollar's reserves through a bug in the Superfluid protocol, a GoodDollar exploit that hit the project's funds on the Celo blockchain. GoodDollar is a project that pays a small daily income to nearly a million people, and its safety pool of funds was the target. KEY TAKEAWAYS The reported reserve drain exceeded $100,000, split across two blockchains. The incident is linked to a bug in the Superfluid protocol on the Celo network. Full technical details, external pool losses, and final recovery status remain unverified. GoodDollar reserves drained of over $100K GoodDollar runs a "universal basic income" program. Members claim a small amount of its G$ token every day. To back that token, the project holds a pool of funds called a reserve. For related coverage, see SEC Approves Nasdaq Texas Commodity Trust Rules With 15% Cap. That reserve is where the money went missing. According to reporting by CryptoSlate, citing a September 9 update from GoodDollar, an attacker exchanged 86,588 cUSD out of the Celo reserve. For related coverage, see Bitrace: Fulilai Removes Merchants Amid Xinbi Crackdown. Reported Celo reserve outflow 86,588 cUSD CryptoSlate, citing GoodDollar’s September 9 update, reports that 86,588 cUSD was exchanged out of the Celo reserve. The amount has not been independently verified on-chain; it does not represent full reserve depletion. A second, smaller amount came from the project's reserve on the XDC network. That outflow was $20,857, the same reporting states, though the route linking it to the Celo bug is not explained. For related coverage, see U.S. Bank Tests USBDC Stablecoin Payment on Stellar. Reported XDC reserve outflow $20,857 CryptoSlate, citing GoodDollar’s September 9 update, reports a $20,857 XDC reserve outflow. The amount has not been independently verified on-chain, and the route connecting this outflow to the Celo-specific bug remains unexplained. Together, those two figures make up the "more than $100,000" in the headline. Importantly, GoodDollar said the Celo and XDC reserves were not fully emptied. These are reported amounts, not on-chain confirmed totals. The reported Superfluid bug connection The drain traces back to Superfluid, a protocol that lets users send "money streams," meaning payments that flow continuously over time. GoodDollar uses it to distribute its daily income. Superfluid's Security Council explained the flaw in a preliminary disclosure posted September 8. A malicious "Super App," an automated program plugged into Superfluid, bypassed the normal stream liquidation process on Celo. In plain terms, balances that should have been shut off stayed active. The attacker then exchanged those balances against GoodDollar's reserve assets and other Celo liquidity pools, the council said. The council stressed the bug depended on Superfluid's specific Celo setup. All other networks running Superfluid were unaffected by this particular flaw.