GoodDollar Incident Post-Mortem: September 4 Attack

Community
1

Summary

On September 4, an attacker drained roughly $86,000 from GoodDollar’s Celo reserve and roughly $19,000 from Celo’s DEX pools, where liquidity was largely supplied by the Good Labs foundation. A further $20,000 was extracted from the XDC reserve by arbitrageurs unrelated to the attacker. Total losses were roughly $125,000.

The root cause was a flaw in Superfluid’s Celo deployment, not a bug in the GoodDollar Reserve. Superfluid has acknowledged the issue and fixed it. Read its reports here.

All affected contracts have since been restored. The protocol state, including G$ supply, reserve value, and G$ price, was returned to its pre-attack level, with Good Labs covering the cost. The attacker’s funds were traced with Hypernative’s help to what are probably two sanctioned entities, so recovery through cooperation is unlikely. One item remains open: a Uniswap V4 pool on Celo is still blocked (see “Open item” below).

What happened

The attacker used a malicious Super App, a smart contract that Superfluid calls back whenever a payment stream is opened, changed, or closed. The contract let nine G$ streams keep running after the sender’s balance hit zero and prevented anyone except the attacker from closing them.

As a result, about 2.8B G$ was streamed into the attacker’s contract and sold into the Mento reserve (the reserve that backs G$) and external liquidity pools.

Malicious Super App contract:

0x932424d333475F48ABcD9A61F570416B542bB94d

Streams on the Superfluid explorer

The reserve’s circuit breakers, which cap how much G$ can be sold into the reserve within a set period, stopped the attacker from selling more and limited the damage. However, the breaker resets after each measurement period, and the attacker timed the attack around that reset.

Tracing the attacker’s funds

With the help of Hypernative, Good Labs traced the attacker’s funds to what are probably two sanctioned entities, Huobi and swapster.fi. Cooperation from the recipients is unlikely, and recovery of the funds is not expected.

The attacker buyer address has been flagged on the block explorer as having been used in a phishing scam. The warning was reported by Hypernative.

Attacker buyer address: 0x5eC2418E24cC9Dead4bB8e062d226Bb70a1d05c8

Timeline

All times are UTC

Date & time Event
Sept 4, 07:50 GoodBuilders community member alerted the team to a sharp drop in the G$ price on CoinGecko and CoinMarketCap. This prompted an investigation, which uncovered the attack.
Sept 4, 10:49 Celo reserve, bridge, G$ token, identity, and UBI contracts paused.
Sept 4, 12:38 Root cause identified and acknowledged by Superfluid.
Sept 4 Superfluid liquidated all nine streams.
Sept 4, 19:00 XDC reserve paused
Sept 7 Planned recovery plan (below).
Sept 8 G$ token unpaused. Trading was detected, so the token was paused again after a couple of hours and transfers from G$ liquidity pools were blocked.
Sept 9 G$ token unpaused again.
Sept 28 Burn plan fully executed. All liquidity pools unblocked except the Celo Uniswap V4 pool, which holds 550M G$.
Sept 28 Burn and refund calculations published, along with an appeals process: GoodDollar Recovery Burn and Refund Report
Sept 29 Celo and XDC reserves unpaused after their USD holdings and parameters were restored.
Sept 29 - Oct 13 Refunds appeal period
Oct 15 Refunds executed

Recovery plan and results

Good Labs aimed to resume G$ and UBI claiming as soon as possible and restore the protocol to its pre-attack state. Good Labs carried out the recovery on GoodDAO’s behalf through the Protocol Guardians’ emergency process:

Goal Action Who bore the cost
Restore total G$ supply Burned the attacker’s excess G$ and the G$ it dumped, which others had bought cheaply from the liquidity pools Good Labs refunded the buyers
Restore reserve value Restored the USD value of the Celo and XDC reserves Good Labs
Restore G$ price Restored the reserves’ AMM (automated market maker) parameters n/a

G$ and UBI claiming were unpaused on September 9. The burn plan was completed by September 28, and the reserves reopened on September 29.

Refunds were determined by reviewing each holder’s purchases, sales and transaction prices. Eligible holders with a verified net loss received that loss plus 10%. No refund was given where the review showed a net profit. The appeal period closed on 13 October 2026 at 23:59 UTC. Eligible refunds were processed on October 15.

Refunds TX:

https://celo.blockscout.com/tx/0x31d6778e17f9dd927694f98e556075f080acf72223865f0e825daa52416ba5f1?tab=token_transfers

https://xdcscan.com/tx/0x56b27cbdb54c8c2350ecff42faaf9ab0e71ba9d7120b2a0becc7a882a82f1841

More details are available in the Recovery Burn and Refund Report.

Security updates and learnings

  • Response time. A community report led to on-chain triage within hours, and the Celo contracts were paused quickly, but response can be faster. Good Labs will update its crisis response documentation to be able to issue a pause quicker by the person on-call and quicker permissions handover from the Protocol Guardians.
  • Monitoring. Existing monitoring did not detect the attack. It has since been refined and extended to cover external protocols and tokens integrated with GoodDollar.
  • Circuit breaker. Because the current breaker resets at the end of each period, the attacker could time the attack around the reset. A rolling-window breaker is planned. In the meantime, the reserve limits have been reduced.
  • Emergency controls. The G$ token will be upgraded to allow the creation of new streams and increases to existing ones to be paused in an emergency. Deleting streams remains limited to Superfluid governance.

Open item: Uniswap V4 pool

The Celo Uniswap V4 pool still holds 550M G$ and remains blocked. The holder of the Uniswap V4 position (wallets: 0xe58185fbb9e8cf2bbee7ffb4657502414ca29055 and 0x22fA3239c4bf43D05CC587ff40ea3bA5841C6709) can contact Good Labs at techadmin@gooddollar.org or transfer the position to the Good Labs Safe on Celo at 0x4e31993d9F13F940828bf9eC2f643A7E55B21e8C to enable the pool to be unblocked. If no one comes forward, G$ trading on the Celo Uniswap V4 pool will remain unavailable.

The position holder has participated in past DAO votes; cooperation would help restore trading on the pool.

Attempts have been made to contact the position holder through the governance forum and the relevant block explorers.

Going forward

Good Labs is committed to the success and security of the protocol. The lessons from the first hack helped prevent greater losses this time, and new security measures will be implemented to prevent and minimize future attacks.

GoodDollar’s vision is a fairer economy, and the response aimed to reflect that principle. Community members who traded during the incident did nothing wrong. Anyone who benefited from the incident may choose to voluntarily return some of those gains to the community.

Contact Good Labs Foundation or contribute to the wallet:

ENS: standwithgooddollar.eth
Ethereum Wallet Address: 0xA5e51aF835a0cDf7D5cE12ee15A3A5cD49A6E958

2

To the GoodDollar Team, Guardians, and Community: Your own official Incident Post-Mortem makes the facts indisputable. In the report, you explicitly state:

:speech_balloon: “Community members who traded during the incident did nothing wrong.”

In my case, every single $G$ token I held was purchased directly inside the official GoodWallet and subsequently deposited into Ubeswap. These tokens were acquired legally through the market and had absolutely nothing to do with the Superfluid exploit. Yet, your team went out of its way to burn my tokens and dismantle the staking pools on Ubeswap.

1. The Flaw in the “Ethics” Argument:

If you claim “ethics” or “fairness” as the basis for confiscating open-market purchases, where were those principles during the previous exploit? Back then, I bought $G$ at all-time highs and lost approximately $40,000 USD when the market crashed. No one offered a refund, a price adjustment, or a 10% compensation. As a holder, I was forced to absorb 100% of that loss because “market risk applies.” You cannot invoke “ethics” only when it benefits the Foundation to seize user gains, while ignoring holder losses during protocol crashes.

2. Unauthorized Settlement:

I never authorized nor approved a forced refund in USDT, nor the arbitrary +10% calculation. A decentralized protocol has no authority to unilaterally liquidate a user’s legitimate holdings or dictate their trade value post-facto.

3. Contradiction of Core Principles:

You acknowledge that buyers did nothing wrong, yet you penalized us using emergency powers without a DAO vote.

I reject this forced settlement. I demand the full return and restitution of my legally acquired $G$ tokens.

3

Dear G$ Team, I am formally reporting an discrepancy regarding Ubeswap G$ staking. Although staked G$ was refunded following the recent liquidity incident, rewards are still being distributed based on pre-incident staking balances. Based on data from Celoscan and the Superfluid explorer, participants who received reimbursements continue to accrue rewards due to their holdings of Ubeswap G$ POOL tokens, while staking, unstaking, and restaking functionalities remain inactive. Could you please resolve this matter, and restore full staking, unstaking, and restaking functionality to Ubeswap

https://celoscan.io/token/0xfe28a35a1883400F30AFd87DBCdd6F4f8E41114c#balances

4

In your official report, you write that returning gains is VOLUNTARY. Why then were my legally purchased G$ tokens forcibly burned from Ubeswap without my consent? You talk about ‘voluntary contributions’ in public, but executed an administrative confiscation in practice. Respect your own words: if it is voluntary, restore my G$ tokens immediately."

5

Hey everyone in the community! :police_car_light:
I’m posting this here because I’m genuinely concerned and taken aback by what just happened.
If what Glenn experienced is true, this is a serious matter that affects us all as a community.
Web3 was built on fundamental principles that we cannot take for granted: decentralization, transparency, due process, and immutability.
When such drastic measures are taken—without a clear statement or transparent explanation regarding the reasons behind the confiscation or burning of funds belonging to legitimate buyers—it undermines the very trust upon which this entire ecosystem is built.
If we truly want to be a decentralized DAO that aligns with Web3 values, we cannot ignore or overlook situations like this.
We demand an official statement and a detailed explanation of what occurred.
If these principles can be violated in the case of one community member, it could happen to any of us tomorrow.
Does anyone else have a clear understanding of what took place, or is there an official stance from the team?

This warrants our collective attention and investigation.

6

Thank you, Eddie, for bringing this forward and calling for basic accountability and Web3 principles.

What happened to my account feels like a targeted, personal administrative move rather than an objective, code driven protocol decision. The facts are clear and fully verifiable on-chain:

1)My G tokens were purchased directly inside the official GoodWallet and subsequently staked on Ubeswap.

2)They had zero involvement in the Superfluid exploit.

3)Yet, the administrators selected my position, forcibly dismantled the Ubeswap staking pools, burned my tokens, and imposed an unauthorized settlement.

If this was an automated protocol recovery, why were legitimately purchased tokens targeted?

I demand a direct, public explanation from the administrative members and Guardians who executed these actions:

  • To the Guardians / Good Labs Team: Did my tokens interact with the exploit contracts, or did you make an arbitrary administrative decision to seize assets from a legitimate market buyer?
  • On Authorization: By what governance mandate or legal right did you liquidate tokens purchased in your own official app without user consent?
  • On Due Process: Why does the official Post-Mortem state that “community members who traded during the incident did nothing wrong”, while administrative members simultaneously executed a forced burn on my balance?

FORMAL DEMAND FOR TOKEN RESTITUTION & REASONING

I formally demand the full and immediate return of all my legitimately acquired $G$ tokens. The protocol must credit back the exact amount of $G$ seized, based on the following undeniable grounds:

  1. Legitimate Acquisition & On-Chain Provenance: Every single token was purchased using legitimate funds directly through the official GoodWallet interface and deposited into open Ubeswap pools. These were not exploit funds, unbacked streams, or fraudulent mints.

2)Violation of Decentralized Governance (Smart Contract Inviolability): Unilateral administrative burn executed via emergency multisig controls without a formal DAO vote violates the fundamental trust in smart contract immutability.

3)Non-Consensual Liquidations: A decentralized protocol cannot force a fiat-style settlement (USDT + 10%) on a user who never requested nor accepted it. Market participants buy $G$ for its long-term protocol and utility value, not for forced corporate redemptions.

4)Alignment with Official Protocol Declarations: Since your own Incident Report explicitly confirms that market buyers did nothing wrong, keeping my tokens burned creates an irreconcilable contradiction between your public statements and operational actions.

If the core administrators can bypass the DAO to penalize specific key holders and liquidate legitimate purchases, this is no longer a decentralized protocol it is a centralized entity with manual override.

The team members who authorized this burn must step forward, explain these actions, and restore my $G$ tokens to their rightful holder. True Web3 governance requires nothing less.