Pre-execution brief Verdict: protective governance hardening

ether.fi Core Upgrade Timelock — Pending Operation `0x244e...359f`

Pre-execution calldata, LayerZero V2 EndpointV2 delegate trace, and EIP-1967 storage-layout audit for institutional weETH / eETH vault risk curators.

Protocol: ether.fi
Timelock: 0x9f26…0761 · 10d minimum delay
Operation: 0x244e3f…359f
Execution window: ETA 2026-11-20 16:54 UTC · 2026-11-20 16:54:11 UTC
State: Pending at finalized block #26,406,890 (2026-11-13 15:18 UTC) Scanner-pinned (L1 finalized)

OApp & Adjacent Backing

46.92 ETH Float

Adjacent to 121,009.28 weETH LockBox

Timelock Window

10.00 Days (864,000s)

ETA: 2026-11-20 16:54:11 UTC

Decoded Call

setDelegate(address)

Selector 0xca5eb5e1 -> 10d Timelock

Storage Collision

0 Slots Shifted

debug_traceCall 0x00 (38,771 gas)

1. What Is Queued & Why It Matters for weETH Allocators

In Ethereum Mainnet transaction 0x2c052a89c3f8d2782b7cb40ecfa7db5f72bab73d625aa1ad485fea6da24586a4 (block 26385837), ether.fi's 6-of-10 Proposer Safe (0xcdd57D11476c22d265722F68390b036f3DA48c21) scheduled operation 0x244e3f6c3df722246c471cee58804dd34c7703fce9cee1eadc1c5a85f171359f on EtherFiTimelock (0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761) targeting EtherfiL1SyncPoolETH (0xD789870beA40D056A4d26055d0bEFcC8755DA146) — the LayerZero V2 inbound native-ETH minting SyncPool OApp wired into Liquifier (0x9FFDF407cDe9a93c47611799DA23924Af3EF764F), carrying 46.92 ETH in-flight unbacked sync float and operating alongside the separate L1 LockBox (0xcd2eb13D6831d4602D80E5db9230A57596CDCA63, holding 121,009.28 weETH).

Pre-Execution Delegate Split-Brain: While EtherfiL1SyncPoolETH.owner() and ProxyAdmin.owner() (0xDBf6bE120D4dc72f01534673a1223182D9F6261D) already enforce the 10-day timelock, OpenZeppelin transferOwnership does not update LayerZero V2 EndpointV2.delegates(oapp) (0x1a44076050125825900e736c501f859c50fE728c, selector 0x587cde1e), which remained on a 0-second 4-of-7 Safe (0x2aCA71020De61bb532008049e1Bd41E451aE8AdC) as the verification root for inbound cross-chain sync messages. (By contrast, the separate 121,009.28 weETH L1 LockBox OApp already has matching owner() == EndpointV2.delegates() == 0xcD425f44758a08BaAB3C4908f3e3dE5776e45d7a.)
Post-Execution Hardening (Nov 20, 16:54 UTC): Executing setDelegate(0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761) aligns EtherfiL1SyncPoolETH LayerZero DVN verifier & receive-library configuration 1:1 with the 10-day EtherFiTimelock.
Peer Collateral Contrast: Brings weETH / eETH inbound SyncPool LayerZero governance behind a full 10-day exit window, contrasting favorably against peer cross-chain collateral architectures where TimelockController selector whitelists retain 0-second multisig paths on cross-chain adapter configuration.

2. Deterministic Verification & Implementation Storage Audit

Verification Check	On-Chain / Cryptographic Evidence (Pinned Ethereum Block `26405767` / `26405868`)	Status
OZ `hashOperation` Preimage	`keccak256(abi.encode(0xD789..DA146, 0, 0xca5eb5e1..0761, 0x00..00, 0x8d5b64ec..4cab))` == `0x244e3f6c...1359f`	Pass
Archive `debug_traceCall`	`Timelock -> Proxy -> DELEGATECALL Impl (0x5d31..3aBD) -> CALL EndpointV2.setDelegate` returns `0x` (38,771 gas)	Pass
Impl Storage Diff (`0x2c28..0155` -> `0x5d31..3aBD`)	Added `PausableUntil` uses custom slot `0x2c7e4bc0...f1e1fea2` (0 sequential slots); `_liquifier`, `_eEth`, `_dummyTokens` preserved; `_paused` tail-appended; `_roleRegistry` (`0x6224..7cE9`) is bytecode `immutable`	Safe
Adjacent L1 LockBox OApp Check	`LockBox` (`0xcd2e..CA63`, `121,009.28 weETH`): `owner() == EndpointV2.delegates() == 0xcd42..5d7a` (zero split-brain)	Aligned

3. Curator Monitoring Summary

Pre-Nov 20 (16:54 UTC): No defensive supply/collateral cap reduction indicated for weETH markets on Morpho, Aave, or Euler; watch EndpointV2 (0x1a44076050125825900e736c501f859c50fE728c) for any unexpected 0s SetConfig or library events from 0x2aCA...8AdC prior to execution.
Post-Nov 20 (16:54 UTC): Verify CallExecuted(0x244e...359f) on EtherFiTimelock and confirm EndpointV2.delegates(0xD789...DA146) == 0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761.

For issuers

Issuing ether.fi? Reconcile & Anchor 24h Institutional Clearance

Reconcile documentation drift, verify multisig and timelock control planes across archive RPCs, prepare an upstream docs reconciliation PR, and anchor a Base EAS Aligned Attestation + Curator Diligence Dossier within 24 hours.

Request 24h Clearance ($5,000 USDC) →Request Commercial Invoice (PDF)