{"investigation":{"slug":"gooddollar-superfluid-celo-reserve-exploit","entity_name":"GoodDollar (Superfluid/Celo Reserve Exploit)","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.55,"status":"draft","content_type":"investigation","summary":"GoodDollar, a universal-basic-income protocol that has distributed roughly 2.3 billion G$ tokens to over 963,000 claimants, disclosed on September 9, 2026 that its Celo and XDC reserves were drained after an attacker exploited a bug in Superfluid's Celo deployment. The attacker allegedly used a malicious 'Super App' to bypass Superfluid's whitelisting and liquidation safeguards, keeping insolvent G$ balances active and exchanging the excess tokens for at least $100,000 in real reserve assets. This is the second major reserve-draining incident in GoodDollar's history, following a December 2023 exploit that saw roughly 14 billion G$ minted illicitly, and as of mid-September 2026 both GoodDollar and Superfluid have yet to publish full incident reports.","sections":[{"content":"On September 9, 2026, GoodDollar disclosed that 86,588 cUSD had been exchanged out of its Celo reserve and a further $20,857 out of its XDC reserve, after a malicious 'Super App' exploited a bug specific to Superfluid's Celo deployment. According to GoodDollar and Superfluid's public statements as reported by CryptoSlate, the malicious application bypassed a whitelisting requirement in Superfluid's Celo contracts and kept insolvent G$ balances active instead of triggering their liquidation. Those excess, unbacked G$ balances were then allegedly exchanged against real assets held in the GoodDollar Reserve and in other liquidity pools. Superfluid said it detected insolvent accounts on September 3, 2026 and traced the failure to the Super App bug the following day (September 4). Combined losses from the GoodDollar reserves alone exceeded $100,000; losses to external G$ liquidity pools were acknowledged as affected but remained undisclosed at the time of reporting. Celo hosts roughly 2.4 billion G$ tokens, about 28% of total G$ supply, meaning the affected chain represents a substantial share of the protocol's economic base.","heading":"September 2026 Superfluid/Celo Exploit — Reserve Drain","sources":[{"url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"CryptoSlate: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","credibility":2},{"url":"https://medium.com/gooddollar/gooddollar-community-update-navigating-challenges-and-forging-ahead-2c59db554a92","name":"GoodDollar Community Update: Navigating Challenges and Forging Ahead","type":"official","credibility":2}],"severity":"critical"},{"content":"A significant unresolved discrepancy in the September 2026 incident is that Superfluid's Security Council stated the underlying vulnerability existed only in its Celo deployment and that other Superfluid networks were not exposed to the same flaw, yet GoodDollar separately reported a $20,857 loss from its XDC Network reserve. As of mid-September 2026, neither GoodDollar nor Superfluid had publicly explained the technical mechanism by which a Celo-specific bug produced an outflow on a separate chain (XDC), where Superfluid's contracts are reportedly not deployed in the same way. This gap is flagged as an open question pending the incident reports both organizations said they were preparing.","heading":"Unexplained XDC Reserve Loss","sources":[{"url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"CryptoSlate: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","credibility":2}],"severity":"high"},{"content":"This is not GoodDollar's first reserve-related security incident. In mid-December 2023, the GoodDollar Reserve smart contract was allegedly exploited via untrusted input, resulting in the unauthorized withdrawal of roughly 627,000 cDAI from the reserve and the improper minting of approximately 14 billion G$ tokens — reportedly a supply increase of around 233%. The attacker allegedly sold approximately 1 billion of the illegitimately minted G$ on Celo and Fuse decentralized exchanges, causing the token's market price to fall by an estimated 95%. In response, the GoodDAO paused core protocol contracts, and the Good Labs Foundation temporarily disabled the GoodWallet and GoodDapp applications, restoring functionality within one to two days. The GoodDAO, via its Protocol Guardians, subsequently burned approximately 3.6 billion of the illicitly minted G$ tokens to partially reverse the supply inflation. This earlier incident indicates a recurring pattern of smart-contract-level vulnerabilities affecting GoodDollar's reserve mechanism across more than one exploit, roughly two and a half years apart.","heading":"Prior Incident: December 2023 Reserve Exploit and 14 Billion G$ Mint","sources":[{"url":"https://medium.com/gooddollar/gooddollar-community-update-navigating-challenges-and-forging-ahead-2c59db554a92","name":"GoodDollar Community Update: Navigating Challenges and Forging Ahead","type":"official","credibility":2},{"url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"CryptoSlate: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","credibility":2}],"severity":"high"},{"content":"Following disclosure of the September 2026 incident, Superfluid stated it deployed a hotfix, reinstated Super App whitelisting on its Celo deployment, and closed the affected accounts. GoodDollar stated that its Celo and XDC reserves \"were not depleted,\" attributing this to monitoring alerts, emergency pauses, and existing protocol safeguards that limited the scope of the loss relative to total reserve holdings. As of the reporting, G$ claiming, transfers, and identity verification had resumed on Celo, but reserve operations and cross-chain bridging remained paused pending the completion of separate incident reports that GoodDollar and Superfluid each said they were preparing. No date had been given for when those reports, or a full accounting of losses to external G$ liquidity pools, would be published.","heading":"Response, Remediation, and Ongoing Operational Restrictions","sources":[{"url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"CryptoSlate: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","credibility":2},{"url":"https://medium.com/gooddollar/gooddollar-community-update-navigating-challenges-and-forging-ahead-2c59db554a92","name":"GoodDollar Community Update: Navigating Challenges and Forging Ahead","type":"official","credibility":2}],"severity":"medium"},{"content":"GoodDollar is a decentralized protocol that describes itself as distributing a daily universal basic income (UBI) in its native G$ token to verified users, funded by a reserve of stablecoins and other assets and governed by the GoodDAO. Per GoodDollar's own reporting (as cited in coverage of the September 2026 incident), the protocol has distributed approximately 2.3 billion G$ tokens to over 963,000 claimants. The G$ token's value is intended to be backed by reserve assets held across multiple chains, including Celo, XDC Network, Fuse, and Ethereum, with the reserve's solvency directly underpinning the credibility of the UBI distribution model. Because the reserve backs a live income program for a large, and reportedly economically vulnerable, user base, any exploit that reduces reserve backing carries outsized real-world consequences relative to typical DeFi protocol hacks.","heading":"Background: GoodDollar Protocol and UBI Model","sources":[{"url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"CryptoSlate: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The September 2026 incident implicates Superfluid, the money-streaming protocol whose Super App framework GoodDollar relies on for its UBI distribution mechanics, rather than GoodDollar's own contracts alone. Superfluid's Security Council attributed the vulnerability specifically to its Celo deployment and stated other networks using Superfluid were not exposed to the same flaw. Independent verification of Superfluid's full incident report, and of whether this represents an isolated Celo-specific defect versus a broader pattern in Superfluid's Super App whitelisting design, was not available as of this writing; a fuller technical post-mortem from Superfluid was reported as pending.","heading":"Superfluid Security Track Record","sources":[{"url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"CryptoSlate: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2023-12","event":"GoodDollar Reserve smart contract allegedly exploited via untrusted input; attacker withdrew roughly 627,000 cDAI and minted approximately 14 billion G$ tokens, inflating supply by an estimated 233%. GoodDAO paused core protocol contracts and later burned approximately 3.6 billion of the illicit G$.","source":"GoodDollar Community Update / CryptoSlate","source_url":"https://medium.com/gooddollar/gooddollar-community-update-navigating-challenges-and-forging-ahead-2c59db554a92"},{"date":"2026-09","event":"Superfluid detected insolvent accounts on its Celo deployment.","source":"CryptoSlate","source_url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","date_evidence":"Superfluid detected insolvent accounts on Sept. 3 and traced the liquidation failure to the Super App bug the following day.","date_original":"2026-09-03"},{"date":"2026-09","event":"Superfluid traced the liquidation failure to a bug in a malicious Super App.","source":"CryptoSlate","source_url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","date_evidence":"Superfluid detected insolvent accounts on Sept. 3 and traced the liquidation failure to the Super App bug the following day.","date_original":"2026-09-04"},{"date":"2026-09","event":"GoodDollar publicly disclosed the exploit, reporting 86,588 cUSD drained from its Celo reserve and $20,857 from its XDC reserve.","source":"CryptoSlate","source_url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","date_evidence":"GoodDollar said on Sept. 9 that 86,588 cUSD was exchanged out of its Celo reserve and another $20,857 from its XDC reserve after a malicious Super App bypassed Superfluid's liquidation safeguards.","date_original":"2026-09-09"},{"date":"2026-09","event":"Superfluid deployed a hotfix, reinstated Super App whitelisting on Celo, and closed affected accounts; GoodDollar resumed claiming, transfers and identity verification on Celo while reserve operations and bridging remained paused pending incident reports from both projects.","source":"CryptoSlate","source_url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/"}],"sources_used":[{"url":"https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"CryptoSlate: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","archive_url":"http://web.archive.org/web/20260914120906/https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","credibility":2,"archive_timestamp":"2026-09-14T12:09:06+00:00"},{"url":"https://medium.com/gooddollar/gooddollar-community-update-navigating-challenges-and-forging-ahead-2c59db554a92","name":"GoodDollar Community Update: Navigating Challenges and Forging Ahead","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinethereumnews.com/crypto/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","name":"BitcoinEthereumNews mirror: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","archive_url":"https://web.archive.org/web/20260915013308/https://bitcoinethereumnews.com/crypto/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/","credibility":2,"archive_timestamp":"2026-09-15T01:33:08+00:00"},{"url":"https://bitrss.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted-250114","name":"BitRss mirror: A crypto project paying nearly 1 million people a daily income just had its reserves looted","type":"news_article","archive_url":"https://web.archive.org/web/20260915013315/https://bitrss.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted-250114","credibility":2,"archive_timestamp":"2026-09-15T01:33:15+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-14T23:27:30.189805+00:00","updated_at":"2026-09-15T04:19:30.939332+00:00"}}