A crypto project paying nearly 1 million people a daily income just had its reserves looted

On September 9, 2023, a serious vulnerability in the GoodDollar project, a decentralized universal basic income protocol, became public knowledge. An attacker exploited a bug within the Superfluid protocol on the Celo blockchain, successfully draining more than $100,000 from GoodDollar's reserves. This incident not only raises questions about the security of decentralized finance (DeFi) systems but also threatens the viability of GoodDollar's daily income program, which has already distributed 2.3 billion G$ tokens to over 963,000 recipients.

Understanding GoodDollar's Model

GoodDollar aims to provide a universal basic income (UBI) through its G$ token, giving users a regular income stream in a decentralized manner. The project has gained traction, particularly during a time of economic uncertainty, where traditional welfare systems often fall short of meeting individuals' needs.

The operational backbone for GoodDollar involves:

• Token Distribution: Users register to receive daily G$ distributions.
• Reserves and Liquidity: The reserves are primarily backed by stablecoins, and yield generated through DeFi investments supports the ongoing issuance of G$ tokens.
• Broad Reach: With a user base that has grown to nearly a million claimants, GoodDollar has positioned itself as a significant player in the DeFi landscape.

The Attack: A Deep Dive

The vulnerability exploited was specific to the Celo deployment of the Superfluid protocol. An attacker managed to create excess G$ tokens and subsequently exchanged 86,588 cUSD from GoodDollar’s Celo reserves, as well as another $20,857 from its XDC reserve. The malicious application bypassed crucial liquidation safeguards intended to protect the integrity of these reserves.

The Technical Breakdown

• Celo Blockchain: GoodDollar operates extensively on the Celo network, which holds about 28% of the total G$ supply, translating to approximately 2.4 billion G$ tokens. The network is noted for its mobile-first approach, catering primarily to users in emerging markets.

• Superfluid Protocol: This protocol allows for the streaming of assets, enabling users to earn yield continuously. However, a bug allowed the malicious application to bypass a whitelisting requirement, leaving insolvent G$ balances active when they should have been liquidated.

• Immediate Response: Upon discovering the exploitation on September 3, Superfluid's Security Council quickly implemented a hotfix to reinstate whitelisting on Celo and close affected accounts. However, the implications were substantial, with external G$ liquidity pools also impacted, although losses in these areas have not been fully disclosed.

Current Status and Implications

In the aftermath of the attack, GoodDollar has paused reserve operations and bridging, warning users against swapping G$ until liquidity improves. Claiming, G$ transfers, and identity verification on Celo have resumed, but the pause on reserve operations raises questions about the long-term implications for the program's financial stability.

The Unexplained XDC Loss

Despite the assurances from Superfluid that the underlying vulnerability was confined to Celo, GoodDollar reported a loss of $20,857 from its XDC reserve, adding confusion to the situation. Neither project has detailed how excess G$ may have reached or affected the XDC network.

Broader Implications for DeFi

This incident is a stark reminder of the inherent risks associated with DeFi platforms. While the promise of high yields and decentralized operations attracts users, the lack of regulatory oversight and the complexity of smart contracts can expose projects to severe vulnerabilities.

Repercussions for Users and Investors

• Liquidity Risks: The incident highlights the fragile nature of liquidity in DeFi ecosystems. Users should remain cautious of thin markets, which can lead to significant slippage in token prices.

• Increased Scrutiny: As incidents like this come to light, it is likely that more users and potential investors will demand a higher level of transparency and security from DeFi projects.

• Future of UBI in Crypto: The GoodDollar project has been a beacon of hope for those advocating for UBI as a solution to economic disparity. However, this incident raises concerns about the sustainability and reliability of such models in the crypto sphere.

Lessons Learned and Moving Forward

In the wake of this exploit, both GoodDollar and Superfluid are working on incident reports to provide a comprehensive overview of the losses incurred and to outline strategies for restoring liquidity. GoodDollar has committed to addressing the excess G$ and resuming its paused functions.

Recommendations for DeFi Projects

1. Robust Security Audits: Conducting thorough audits of smart contracts and protocols can help identify vulnerabilities before they are exploited.

2. Transparent Communication: Maintaining clear communication channels with users about risks, operational changes, and recovery efforts is essential for fostering trust.

3. User Education: Educating users about the risks of interacting with DeFi protocols, including the potential for slippage and liquidity issues, could mitigate losses in the future.

Conclusion

The heist of over $100,000 from GoodDollar's reserves underscores the delicate balancing act required in the DeFi landscape. While the ambition of providing universal basic income through a decentralized platform is commendable, the security vulnerabilities exposed in this incident serve as a cautionary tale for both developers and users in the crypto space. As the industry matures, it will be essential to prioritize security and transparency to build confidence among participants in this rapidly evolving financial ecosystem.

GoodDollar's journey ahead will be watched closely, not only by its users but also by the broader crypto community as a reflection of the challenges and opportunities that lie ahead in the quest for a more equitable financial future.