A crypto project paying nearly 1 million people a daily income just had its reserves looted
A Superfluid bug let an attacker drain greater than $100,000 from GoodDollar reserves by creating extra G$ on Celo.
GoodDollar said on Sept. 9 that 86,588 cUSD was exchanged out of its Celo reserve and one other $20,857 from its XDC reserve after a malicious Super App bypassed Superfluid’s liquidation safeguards. External G$ liquidity swimming pools have been additionally affected, although neither project has disclosed the losses there.
GoodDollar is a decentralized universal basic income protocol that distributes G$ tokens daily to registered customers. Its reserve is backed by stablecoins, with yield generated by means of DeFi investments used to assist G$ issuance and UBI distributions.
GoodDollar’s dashboard exhibits greater than 963,000 distinctive UBI claimants and a pair of.3 billion G$ distributed by means of this system, making the reserve central to the token’s financial mannequin and the daily distribution system constructed round it.
Celo bug hit community holding 28% of G$ provide
About 2.4 billion G$ crypto tokens flow into on Celo, roughly 28% of the token’s 8.7 billion circulating provide and second solely to the 4.19 billion on Fuse. Ethereum holds about 1.82 billion G$, whereas XDC accounts for 292.5 million.
Superfluid’s Security Council said the vulnerability was particular to its Celo deployment. A malicious utility was capable of bypass a whitelisting requirement and go away bancrupt G$ balances energetic when they need to have been liquidated. Those extra balances have been then exchanged towards property within the GoodDollar Reserve and different liquidity swimming pools.
Superfluid detected bancrupt accounts on Sept. 3 and traced the liquidation failure to the Super App bug the next day. It deployed a hotfix, reinstated Super App whitelisting on Celo and closed the affected accounts. The council mentioned different Superfluid networks weren’t uncovered to the identical flaw.
GoodDollar mentioned its Celo and XDC reserves weren’t depleted, citing monitoring alerts, emergency pauses and current protocol safeguards. Claiming, G$ transfers and id verification have resumed on Celo.
Reserve operations on Celo and XDC stay paused, nevertheless, whereas bridging is suspended and liquidity in exterior swimming pools stays restricted. GoodDollar has suggested customers towards swapping G$ till liquidity improves, warning that skinny markets may produce important slippage and costs that diverge from regular ranges.
Meanwhile, the XDC loss stays unexplained. Superfluid mentioned the underlying vulnerability existed solely on Celo, but GoodDollar reported one other $20,857 exchanged out of its XDC reserve. Neither project has disclosed how the surplus G$ reached or affected that community.
GoodDollar mentioned it plans to deal with the surplus G$, restore liquidity and reopen the remaining paused features. GoodDollar and Superfluid are making ready separate incident experiences that ought to present a fuller accounting of external-pool losses and clarify how the Celo exploit produced an outflow on XDC.
The submit A crypto project paying nearly 1 million people a daily income just had its reserves looted appeared first on CryptoSlate.
