What happened
GoodDollar's December 2023 exploit drained reserve assets and minted approximately 14 billion unauthorized G$ tokens. The attacker sold part of the newly minted supply through sidechain exchanges, damaging liquidity. GoodDAO paused core contracts and later burned some of the illicitly minted tokens.
Technical root cause
The Reserve accepted untrusted input that enabled unauthorized withdrawals and token minting. The project's public update did not identify the exact vulnerable function or publish a complete execution trace.
How it happened
- The attacker exploited a Reserve contract vulnerability involving untrusted input.
- The exploit enabled unauthorized reserve withdrawals and G$ minting.
- The attacker sold approximately 1 billion G$ through sidechain exchanges.
- GoodDAO paused core contracts, imposed a transaction fee on attacker-held G$, and subsequently burned approximately 3.6 billion illicit tokens.
Protocol details
Classification
Other / Reentrancy
Protocol Type
Yield
Affected asset / contract
GoodDollar
Implementation language
Solidity
Protocol links
Website
@gooddollarorg
Security review history
- Quantstamp View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
