Goldfinch proposes a $250,000 reimbursement after a reported test-contract exploit

What happened

Goldfinch governance opened GIP-85, stating that attackers exploited a five-year-old test contract on 2025-12-02 and proposing to reimburse $250,000 from the remaining bug-bounty budget.

What changed

The proposal introduced a concrete loss-allocation decision that would cover approximately 75% of the governance record's reported $330,000 USDC loss.

What did not change

The candidate does not prove that the vote passed, reimbursement was paid, or the underlying exploit affected Goldfinch's active lending pools or client positions.

Confirmed

• Goldfinch governance published GIP-85 on 2025-12-14.
• The proposal asks voters to authorize $250,000 from the remaining bug-bounty budget for reimbursement.
• The governance record attributes a $330,000 USDC loss to a 2025-12-02 exploit of an old test contract.
• The proposal characterizes the reimbursement as approximately 75% of reported damages.

Still open

• The candidate does not include the exploited contract address, transactions, technical root cause, or independent loss reconciliation.
• The final vote result and any reimbursement transaction are not established.
• Whether the vulnerable test contract shared code, roles, or dependencies with active Goldfinch contracts is not established.
• The identities and eligibility of proposed reimbursement recipients are not stated.

What it means for an advisor

• Add the reported exploit and proposed treasury loss allocation to Goldfinch's incident and governance history.
• Require contract-level confirmation before treating the reported amount or scope as fully reconciled.
• Review whether the incident changes conclusions about deprecated-contract management, bug-bounty reserves, or recovery governance.