ether.fi Cash

card Assessed on OP Mainnet (chain 10)etherfi.gitbook.io

Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Optimism is the Cash core chain: ether.fi's deployed-contracts page says Cash v3 contracts are deployed on Optimism, the technical docs name it the core chain, and the April 2026 account upgrade moved Safes from Scroll. cash-v3 a5024d0 keeps the live roles and timelocks for chain 10 only (deployments/mainnet/10/roles.json#L1-L80); every read is pinned to OP block 157880645. Excluded: Scroll (534352, legacy core, no Spend events in the last 50,000 blocks) and the top-up chains (Ethereum, Base, Arbitrum, HyperEVM).

Outside this assessment

Not scored. The cardholder agreements (Inc. U.S. and International) say the card is issued by Third National under a licence from Visa, and that the issuer does not hold or control the user's wallet. For Nigeria the card is marketed by BANEX Microfinance Bank, licensed by the Central Bank of Nigeria.

ether.fi's own risks page states that ether.fi is not a regulated financial institution and that card use is governed by the cardholder agreement and the issuer's terms (https://etherfi.gitbook.io/etherfi/resources/ether.fi-whitepaper/risks, https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international). I found no primary source stating Third National's regulator.

Protections such as regulation, safeguarding and legal recourse are not CROPS properties and are not scored. They are shown because a risk assessment should weigh them.

At a glance

Category: Cards
Chain: OP Mainnet
CROPS tally: 5 of 23 hold up · 3 no evidence
Settles in: USDC, USDT, EURC
Security audits: 29 published
Offered: 88 countries
Last edited: 2026-10-13 · History

Censorship Resistance0 FailsWeakest: Admin pause or freeze powers; Settle without the provider; Reliance on hosted services
Open No evidenceWeakest: Contracts verified onchain
Free0 FailsWeakest: Open-source licences; No proprietary dependencies
Privacy0 FailsWeakest: Tracking and analytics; Endpoints can be changed
Security No evidenceWeakest: Secrets and webhook handling

Where it is offered

Offered only in the countries listed. Checked 2026-10-09. Not scored.

The help-centre article lists 88 countries where a physical card is available, plus Belgium and Ireland (eligible, virtual card only) and the United States. The article says that if a jurisdiction is not listed, you cannot apply. In the US, physical cards are limited to 30 states and DC; US residents contract under the separate U.S. Cardholder Agreements. The documents disagree on three countries, and we take the more restrictive reading. Canada is on the help list, but the Terms of Use say the Services are not available to residents or citizens of Canada, so it is excluded. Croatia and Cyprus are on the help list but also on the Prohibited Activities List's "may include" list of prohibited jurisdictions, so they are excluded. The Prohibited Activities List also bars Cuba, Iran, North Korea, Syria and the Crimea, Donetsk and Luhansk regions of Ukraine; none of these is on the allowlist. The International Cardholder Agreements name no countries.

Listed countries (88): Andorra, United Arab Emirates, Antigua & Barbuda, Angola, Argentina, Austria, Australia, Barbados, Bangladesh, Belgium, Bulgaria, Bahrain, Bolivia, Brazil, Bahamas, Belize, Switzerland, Chile, Colombia, Costa Rica, Czechia, Germany, Denmark, Dominica, Dominican Republic, Ecuador, Spain, France, United Kingdom, Guernsey, Gibraltar, Greece, Guatemala, Guyana, Hong Kong SAR China, Honduras, Hungary, Indonesia, Ireland, Isle of Man, Iceland, Italy, Jersey, Japan, St. Kitts & Nevis, South Korea, Cayman Islands, St. Lucia, Liechtenstein, Lithuania, Luxembourg, Latvia, Monaco, Malta, Maldives, Mexico, Malaysia, Nigeria, Norway, New Zealand, Oman, Panama, Peru, Philippines, Poland, Puerto Rico, Portugal, Palau, Paraguay, Romania, Saudi Arabia, Seychelles, Sweden, Singapore, Slovenia, Slovakia, Suriname, El Salvador, Turks & Caicos Islands, Thailand, Trinidad & Tobago, Taiwan, United States, Uruguay, St. Vincent & Grenadines, British Virgin Islands, Vanuatu, South Africa

Evidence (3)2 documented · 1 claimed

Documented
Terms of Use section 1(c) exclude residents or citizens of Canada and of any Restricted Jurisdiction (UN-sanctioned, or where use would be illegal), and allow US residents to use Cash under the U.S. Cardholder Agreements.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/terms-of-use
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Prohibited Activities List (Jurisdictional Restrictions) bars Cuba, Iran, North Korea, Syria and the Crimea, Donetsk and Luhansk regions, and says prohibited jurisdictions may include 30 named countries, among them Croatia and Cyprus.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-prohibited-activities-list
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Claimed
Help-centre article "In which countries is the Cash card available?" lists 88 physical-card countries, Belgium and Ireland as virtual-only, and the US states with physical cards.
help.ether.fi/en/articles/758780-in-which-countries-is-the-cash-card-available
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Settlement token

What the balance is held in and debited from. Shown as context; it does not change any rating.

Token	Class	Issuer	Contract
USDC	fiat-backed stablecoin	Circle	`0x0b2C…Ff85` explorer · Sourcify
USDT	fiat-backed stablecoin	Tether	`0x94b0…8e58` explorer · Sourcify
EURC	fiat-backed stablecoin	Circle

Conversion. The token is sold for fiat when a payment is authorised.

Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.

The card spends from the user's own Safe on Optimism. In debit mode it transfers a spendable stablecoin; in credit mode it borrows one stablecoin against collateral (weETH, WETH, ETHFI, liquid vault tokens and others) and the collateral itself is not spent. Each spend sends the token to a settlement dispatcher for the card issuer (Rain or Reap), which settles the network in fiat. The OP config's spend and borrow list also includes frxUSD and three ether.fi Liquid vault tokens (liquidUSD, liquidReserve, liquidEUR); whether each is enabled under the current Aave v4 lending gateway was not read onchain, so only USDC, USDT and EURC are listed. The Terms name USDC as the borrowed asset, but the sample spend in C1 borrowed USDT, so no single default is marked. USDT is the bridged Tether token seen in that sample; the EURC contract address was not read.

Checked 2026-10-12

Evidence (3)2 verified · 1 documented

Verified
The OP config lists borrowTokens usdc, fraxusd, liquidUsd, usdt, liquidReserve, eurc, liquidEUR; the legacy debit path reverts UnsupportedToken for any token that is not a borrow token (src/modules/cash/CashLendLib.sol).
etherfi-protocol/cash-v3 · deployments/mainnet/10/config.json
commit a5024d0b6e · checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Verified
A sample card spend through CashModule.spend moved USDT (0x94b008aa...) through the lending spoke to SettlementDispatcherRain 0x50A233c4....
0x94b0…8e58 on explorer.optimism.io
0x94b0…8e58 explorer · Sourcify · block 157880145 · checked 2026-10-12
Documented
The Terms say card purchases are funded from supported stablecoins in the user's non-custodial wallet, or by borrowing USDC against eligible crypto collateral.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/terms-of-use
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19

Censorship Resistance

Who can block valid use, and can users route around them?

0 FailsPillar rating: weakest of 5
1 of 5 Partial or better

What would raise this pillar

Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Reliance on hosted services reaching Weak: Intermediaries required, only documented, no public code.

Admin pause or freeze powers

Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

A pause key that halts all card settlement is held by an EOA (and by a 1-of-6 Safe) with no timelock. No contract role can blacklist a single Safe onchain; per-card blocking happens offchain, where the cardholder terms let ether.fi and the issuer deny transactions without notice. ADMIN_ROLE, a 3-of-6 Safe with no timelock, can also de-list a withdrawable asset or raise the withdrawal delay at once. An EOA-held role scores 0.

Evidence (5)4 verified · 1 documented

Verified
RoleRegistry roleHolders(PAUSER) = governance Safe 0xA6cf...AAC4 (3-of-6), EOA 0x9AF1298993DC1f397973C62A5D47a284CF76844D, and Safe 0x427989Bb12f4A390D11e7647d467DeA02b9d2eE3 with threshold 1 of 6; hasRole(PAUSER, 0x9AF1...844D) returns true.
0x5C1E…687B on explorer.optimism.io
0x5C1E…687B explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The PAUSER key 0x9AF1...844D has no code at block 157880645 (an EOA).
0x9AF1…844D on explorer.optimism.io
0x9AF1…844D explorer · Sourcify · block 157880645 · checked 2026-10-07
Verified
pause() needs only PAUSER and unpause() needs UNPAUSER; CashModuleCore.spend (L391) and SettlementDispatcherV2.settle/bridge are whenNotPaused, so one pauser key halts every card settlement at once.
etherfi-protocol/cash-v3 · src/utils/UpgradeableProxy.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
ADMIN_ROLE (the 3-of-6 Safe, no timelock) can remove an asset from the withdrawable list (configureWithdrawAssets) and set the withdrawal delay to any value (setDelays) in one transaction.
etherfi-protocol/cash-v3 · src/modules/cash/CashModuleSetters.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
Cardholder terms let ether.fi and the issuer suspend or cancel the card or deny any transaction at their discretion.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Settle without the provider

Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Merchants are paid by Visa and the issuer offchain. Both onchain steps are role-gated: spend() needs an ether.fi wallet key, and settle()/bridge() need the bridger role. Neither payer nor payee can settle a card payment by calling the contracts. The user's own withdrawal path is exit, not settlement (see S4).

Evidence (3)3 verified

Verified
spend() is onlyEtherFiWallet (role check at CashModuleStorageContract.sol L223-L226), so only an ether.fi key can move funds from a Safe to a settlement dispatcher.
etherfi-protocol/cash-v3 · src/modules/cash/CashModuleCore.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Sample card spend, tx 0xdb50399e...f565, was sent by EOA 0xdC45DB93c3fC37272f40812bBa9C4Bad91344b46 (an ETHER_FI_WALLET_ROLE holder) to CashModule.spend, which borrowed USDT through the Aave v4 spoke and sent it to SettlementDispatcherRain 0x50A2...501C.
0x7Ca0…45F0 on explorer.optimism.io
0x7Ca0…45F0 explorer · Sourcify · block 157880145 · checked 2026-10-07
Verified
The dispatcher pays the issuer-side recipient only through settle() and bridge(), which are restricted to SETTLEMENT_DISPATCHER_BRIDGER_ROLE.
etherfi-protocol/cash-v3 · src/settlement-dispatcher/SettlementDispatcherV2.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Reliance on hosted services

Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Each card payment needs ether.fi's closed authorisation backend and wallet keys, its settlement bridger, the Turnkey enclave that holds the user's key, the Rain or Reap card programme, the issuer Third National, and Visa. None of these is public, and none has a fallback. The payment path is closed and single-vendor.

Evidence (3)2 verified · 1 documented

Verified
roleHolders(ETHER_FI_WALLET_ROLE) = EOAs 0xdC45DB93c3fC37272f40812bBa9C4Bad91344b46 and 0xB42833d6edd1241474D33ea99906fD4CBE893730 (both without code); these keys submit every spend.
0x5C1E…687B on explorer.optimism.io
0x5C1E…687B explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The only public repo is the contracts repo (Forge tests and deploy scripts). The etherfi-protocol and ether-fi GitHub orgs publish no app, backend, card authorisation or relayer code.
etherfi-protocol/cash-v3 · README.md
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The Cash Modules docs say spend requires the caller to hold ether.fi's wallet role.
etherfi.gitbook.io/etherfi/products/cash/cash-modules
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Neutral settlement, disclosed filtering

Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The settlement contracts contain no address or geographic filtering. Sanctions and country screening is disclosed in the Terms and cardholder agreements, and it runs in the closed KYC/backend and at the issuer. It cannot be bypassed, since C2 = 0, and it is not disclosed in code or a versioned repo document. Edge filtering disclosed in docs only = 1.

Evidence (2)1 verified · 1 documented

Verified
Spend validation checks only token, amounts, txId reuse and the spending limit. A search of src/ found no blacklist, sanctions or country logic; the only "frozen" hits are Aave reserve states.
etherfi-protocol/cash-v3 · src/modules/cash/CashModuleCore.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The cardholder agreement excludes persons blocked or sanctioned by the US (OFAC). The Terms of Use exclude UN-sanctioned and listed jurisdictions.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Token and chain freeze risks disclosed

Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Tokens and the chain are enumerated in versioned config. USDC carries Circle's blacklist and pause powers, and Optimism runs a single sequencer. Neither is stated to cardholders; the risks page stays generic. Enumerated in code, assumptions not stated = 2.

Evidence (3)2 verified · 1 documented

Verified
Collateral, borrow and withdrawable tokens for OP are enumerated in config, among them usdc, usdt, eurc, weth, weETH, fraxusd, the liquid vault tokens and op.
etherfi-protocol/cash-v3 · deployments/mainnet/10/config.json
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Native USDC on OP (the main spend/borrow token) has blacklister() = 0x551e855B7355C98534175879A300972856C04d7C and pauser() = 0xb8015408bcBA72BCBb34775c81361FB496051c9B.
0x0b2C…Ff85 on explorer.optimism.io
0x0b2C…Ff85 explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The risks page mentions only generic "restrictions on a specific token" and chain outages. It does not name issuer freeze powers or Optimism's single sequencer.
etherfi.gitbook.io/etherfi/resources/ether.fi-whitepaper/risks
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Open

Is the whole stack visible?

No evidencePillar rating: weakest of 4
0 of 4 Partial or better · 1 no evidence

What would raise this pillar

Contracts verified onchain reaching Weak: Some contracts verified.

Contracts verified onchain

Does the deployed bytecode match public source, and can a third party rebuild it? O1

Under review

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 todayDrift

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The weekly re-check found that a recorded fact changed. This rating counts as unknown until a reviewer re-checks it.

Every settlement-path contract is verified on Sourcify or the explorer, but the Sourcify results are partial matches, not exact ones, and three contracts are explorer-only. The repo ships bytecode-comparison scripts, which is close to the reproducible-build bar, but I did not run them. Partial match = 2.

Evidence (2)2 verified

VerifiedDrift
Sourcify v2 gives match (partial, not exact_match) for the proxies and current implementations of CashModule (impl 0xea20f2df...), RoleRegistry, SafeFactory, DataProvider, Hook, both settlement dispatchers, the Safe beacon, the Safe impl 0x79A6...397e and the upgrade timelock. Not on Sourcify: DebtManager impl 0xec2215..., CashEventEmitter impl 0xeffdcf... and the operating timelock, which are explorer-verified (Blockscout is_verified true).
0x7Ca0…45F0 on repo.sourcify.dev
0x7Ca0…45F0 explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-12
Verified
A Forge script redeploys each implementation locally with the production constructor args and compares the bytecode to OP mainnet.
etherfi-protocol/cash-v3 · scripts/VerifyOptimismProdBytecode.s.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Whole stack published

Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Only the contracts and their deploy scripts are public. The app, web frontend, card backend, settlement bridger and indexer are closed, and no API schema is published. "SDK or contracts only" = 1.

Evidence (1)1 verified

Verified
cash-v3 holds the contracts, deploy scripts and audits. The 23 etherfi-protocol repos and the ether-fi org (0 public repos) include no Cash app, web frontend, SDK, backend, indexer or API schema.
etherfi-protocol/cash-v3 · README.md
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Can be self-hosted

Can a stranger reach a working deployment from the README? O3

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Contract build and deploy docs exist; reproduction was not attempted. Blockers visible from the repo alone: a working card product also needs the closed app, the card backend, a BIN sponsor and an issuer, and none of these can be self-hosted.

Evidence (1)1 verified

Verified
The README gives env vars, forge test and a Setup.s.sol deploy command for the contracts. Addresses are in deployments/mainnet/<chain>/deployments.json.
etherfi-protocol/cash-v3 · README.md
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Interfaces and data export

Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Event schemas and interfaces exist in source, so ABIs can be rebuilt. The method reference lives only on the hosted docs. There is no API schema, and the only export is a cardholder CSV from the closed app, with no payee export. Judgment call: ABIs are derivable but not committed and the API schema is absent, so this does not reach 2; it is "documented only" = 1.

Evidence (3)1 verified · 1 documented · 1 claimed

Verified
Event definitions (WithdrawalRequested, WithdrawalProcessed, Spend, and others) and interfaces under src/interfaces are in source. No ABI JSON, API schema or export format is committed.
etherfi-protocol/cash-v3 · src/modules/cash/CashEventEmitter.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The hosted docs list CashModule write/read methods and events.
etherfi.gitbook.io/etherfi/products/cash/cash-modules
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Claimed
The help centre says cardholders can download card history as CSV from the closed app.
help.ether.fi/en/articles/685844-how-to-download-your-card-transaction-history
checked 2026-10-07

Free

Does the license actually let a third party fork, modify, and run it?

0 FailsPillar rating: weakest of 3
1 of 3 Partial or better

What would raise this pillar

Open-source licences reaching Weak: Source-available (BUSL, SSPL, ELv2, Commons Clause, custom) on a critical repo.
No proprietary dependencies reaching Weak: Documented that production needs a hosted service with no open alternative.

Open-source licences

Does every repository needed to run the product carry an OSI-approved license? F1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The only public repo has no LICENSE file. Per-file SPDX headers are MIT, except six vendored BUSL-1.1 files. Required components (app, card backend, Turnkey, issuer, Visa, KYC) are closed, so F1 is 0 regardless.

Evidence (1)1 verified

Verified
The tree at a5024d0 has no LICENSE or COPYING file (GitHub license API returns 404). Source files carry SPDX MIT headers (164 files), with BUSL-1.1 on 6 vendored files (Aave CAPO adapters, IStargate).
etherfi-protocol/cash-v3 · README.md
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Protection against relicensing

Can the provider unilaterally relicense future versions, and has it committed not to? F2

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

There is no CLA and no commitment, so 2 under the anchor. Judgment call: with no LICENSE at all, "relicensing" adds little risk on top of the F1 gap. I found no prior relicense event.

Evidence (1)1 verified

Verified
At a5024d0 the repo has no CLA, CONTRIBUTING, CLA workflow (only certora-prover, recovery-hash and test workflows) or license-stability statement, and LICENSE has no commit history.
etherfi-protocol/cash-v3 · README.md
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

No proprietary dependencies

Does a production deployment need a proprietary plugin or hosted-only service? F3

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The core product, card payment, cannot run without ether.fi's proprietary backend and keys, the Turnkey signer, the issuer and Visa.

Evidence (2)1 verified · 1 documented

Verified
Card spends only run through ether.fi wallet keys driven by its closed card backend.
etherfi-protocol/cash-v3 · src/modules/cash/CashModuleCore.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The card is issued by Third National under a Visa licence.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Privacy

What can an observer learn, and did the user knowingly choose it?

0 FailsPillar rating: weakest of 5
0 of 5 Partial or better · 1 no evidence

What would raise this pillar

Tracking and analytics reaching Weak: Present, on by default, disclosed in docs.
Endpoints can be changed reaching Weak: Documented workaround.

Tracking and analytics

Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1

0 Fails

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The app and web frontend are closed, so their manifests cannot be inspected. The provider's own privacy policy, however, discloses device fingerprinting and behavioural biometrics. The anchor puts fingerprinting at 0 whether disclosed or not. No trace was run.

Evidence (1)1 documented

Documented
The Privacy Policy lists collection of a device fingerprint, network telemetry, typing and swiping biometric data, and behavioural signals such as copy/paste and mouse movements. It also lists analytics and marketing cookies.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Data collected beyond payment

Does the flow collect anything beyond addresses, amounts, token, and chain? P2

1 Weak

Best evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

KYC is legally required for the card and is disclosed with its basis, but only in the hosted policy, not in code or a repo document. Collection also goes beyond the KYC requirement (behavioural biometrics, device fingerprint, marketing). Disclosed in policy only = 1.

Evidence (1)1 documented

Documented
Policy table maps KYC/AML data (identification, IP, geolocation, transaction data) to the legal-obligation basis; it also lists fraud and personalisation data (device data, fingerprint, behavioural biometrics) and marketing use, under the contract basis.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Payments linkable onchain

What do calldata and events reveal about who paid whom for what? P3

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No merchant or order data goes onchain. Every purchase is still a public event from a long-lived Safe, carrying a per-transaction card id, the BIN sponsor and USD amounts. Referral cashback events publicly link two users' Safes. Judgment call: the txId works like an invoice id that the issuer side can join to merchant data; it is disclosed in the docs' event list. Disclosed tags = 1, not 2.

Evidence (2)2 verified

Verified
Spend emits safe, txId (indexed card-transaction id), binSponsor, tokens, amounts, USD amounts and mode. Cashback and ReferrerCashback events link safes to spender and referrer addresses.
etherfi-protocol/cash-v3 · src/modules/cash/CashEventEmitter.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The sample Spend log has safe 0x1DcE...3e76, txId 0x72cd6c00...f7d4, and USDT moving to SettlementDispatcherRain.
0x380B…1acB on explorer.optimism.io
0x380B…1acB explorer · Sourcify · block 157880145 · checked 2026-10-07

Third parties in the payment flow

Which third parties see a request during a payment, and can they be swapped out? P4

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

A card payment is seen by ether.fi's backend, Rain or Reap, Third National and Visa. Signing goes through Turnkey, and the KYC vendor is not named. These parties are disclosed in docs or code, but none can be swapped by the user. No trace was run. Present and disclosed, not swappable = 1.

Evidence (3)1 verified · 2 documented

Verified
BinSponsor enum names Reap, Rain, PIX and CardOrder; settlement dispatchers per sponsor are set only by the upgrade timelock.
etherfi-protocol/cash-v3 · src/interfaces/ICashModule.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The docs name Turnkey as the signer that owns every Vault.
etherfi.gitbook.io/etherfi/products/cash/vault
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
Issuer Third National and Visa receive transaction and personal data under the cardholder agreement.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Endpoints can be changed

Can RPC and indexer URLs be changed, and is the indexer code public? P5

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Security

Who can cause loss, lock users in, or change the rules?

No evidencePillar rating: weakest of 6
3 of 6 Partial or better · 1 no evidence

What would raise this pillar

Secrets and webhook handling reaching Weak: Secrets in client with a disclosed mitigation.

Who holds funds in transit

Who holds funds between payer and payee, and can the provider redirect them? S1

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

At rest, funds sit in the user's beacon-proxy Safe. When a card payment is made they move to an ether.fi-controlled, upgradeable settlement dispatcher, which the operating timelock can drain to any address. This is a provider-held escrow disclosed in code, so 1. Judgment call: the dispatcher's redirect power reads like the 0 anchor, but the funds are already the card payment owed to the issuer; scored 1 for consistency with Gnosis Pay's settlement Safe. By default, ether.fi plus an ether.fi-chosen third party can also take over a Safe through recovery after 3 days, unless the owner cancels.

Evidence (3)3 verified

Verified
The settlement dispatcher holds spent funds until bridged. withdrawFunds() lets ADMIN_TIMELOCK_ROLE (the 8 h operating timelock) send them to any recipient.
etherfi-protocol/cash-v3 · src/settlement-dispatcher/SettlementDispatcherV2.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
SettlementDispatcherRain is a UUPS proxy (implementation slot 0x759fdbf7...4097), upgradeable by the RoleRegistry owner (upgrade timelock 0x9106...4434).
0x50A2…501C on explorer.optimism.io
0x50A2…501C explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Sample Safe has 1 owner, EOA 0xcb99F1F2D80141A0c8672EB0F99e50019Bbab20D (the Turnkey key). Recovery signers are the ether.fi governance Safe and 0x4F5eB42edEce3285B97245f56b64598191b5A58E, threshold 2, recovery delay 259200 s.
0x1DcE…3e76 on explorer.optimism.io
0x1DcE…3e76 explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Who can upgrade the code

Who can change the contract code, and with how much notice? S2

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Every contract, including every user Safe through the beacon, can be upgraded by a 2-day timelock fed by a 3-of-6 Safe with no modules or guard. Default modules that act on all Safes change behind an 8 h timelock. Both delays exceed the 10 s withdrawal delay (S4), but half the Safe signers are undisclosed and no notice channel is named in the repo. Multisig plus timelock, with undisclosed signers and no notice channel = 2.

Evidence (5)5 verified

Verified
RoleRegistry owner() = upgrade timelock 0x9106...4434. That address is the sole upgrader for every UUPS proxy (RoleRegistry.onlyUpgrader L270-L272) and for the Safe beacon, via SafeFactory.upgradeBeaconImplementation. EIP-1967 admin slots are zero (UUPS).
0x5C1E…687B on explorer.optimism.io
0x5C1E…687B explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
getMinDelay() = 172800 s (2 days). The proposer is governance Safe 0xA6cf...AAC4, and the executor role is not open.
0x9106…4434 on explorer.optimism.io
0x9106…4434 explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Governance Safe (Safe 1.4.1) has getThreshold() = 3 of 6 owners. getModulesPaginated(0x1,10) returns none, and the guard slot is zero. Three owners (0xE63794CF..., 0x566E58ac..., 0x5c8c76F2...) appear in ether.fi's published Ethereum signer list; 0x4024380A..., 0x781C3EF0... and 0xD3107493... are not disclosed anywhere I found.
0xA6cf…AAC4 on explorer.optimism.io
0xA6cf…AAC4 explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
All user Safes are beacon proxies of this beacon. implementation() = 0x79A6...397e, and owner() = EtherFiSafeFactory 0xF4e1...d8CF (so the upgrade timelock controls it).
0x48e1…D1ec on explorer.optimism.io
0x48e1…D1ec explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Default modules, which are enabled on every Safe (ModuleManager.sol L187-L191) and can call execTransactionFromModule, are set by ADMIN_TIMELOCK_ROLE, the operating timelock with getMinDelay() = 28800 s (8 h).
etherfi-protocol/cash-v3 · src/data-provider/EtherFiDataProvider.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Token approval scope

How large an allowance does the SDK ask users to grant, and for how long? S3

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

There is no token approval. Instead, ether.fi's wallet role can pull up to a refilling daily/monthly limit that the user sets, routed only to the settlement dispatchers. Judgment call: this is bounded and narrowly routed but not exact-amount, so 2 (the bounded-allowance anchor). The sample limit ($100k/day) is high, and any default module can move Safe funds outside this limit.

Evidence (2)2 verified

Verified
getData(0x1DcE...3e76) gives spendingLimit dailyLimit 100000e6 and monthlyLimit 1000000e6 (USD, 6 decimals). getDelays() = (10, 10, 10) s for withdrawal, spend-limit and mode changes.
0x7Ca0…45F0 on explorer.optimism.io
0x7Ca0…45F0 explorer · Sourcify · block 157880645 · checked 2026-10-07
Verified
No ERC-20 approve is used. Each spend decrements the Safe's user-set daily and monthly limit, and funds go only to the settlement dispatcher for the chosen BIN sponsor.
etherfi-protocol/cash-v3 · src/modules/cash/CashModuleCore.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Funds safe if provider disappears Derived

If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Chain of reasoning: by S1, funds at rest stay in the user's Safe. By C2 = 0 and C3 = 0, card settlement stops if ether.fi disappears. By O3 = 1, there is no self-hostable frontend. The contract withdrawal path exists in verified source and works while paused. But it needs a signature from the Turnkey-held owner key, which is reached through ether.fi's app, and I found no documented key export. ADMIN_ROLE can also de-list assets instantly. Judgment call: retrieval without ether.fi is a manual contract call that depends on getting the key out of Turnkey, so 1, not 2.

Evidence (3)2 verified · 1 documented

Verified
requestWithdrawal is callable by anyone with Safe-owner signatures, is not whenNotPaused, and only allows whitelisted withdraw assets. processWithdrawal (CashModuleCore L309-L311) is open to anyone after the delay.
etherfi-protocol/cash-v3 · src/modules/cash/CashModuleSetters.sol
commit a5024d0b6e · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
getRecoveryDelayPeriod() = 259200 s (3 days). The withdrawal delay on CashModule is 10 s, and 27 OP tokens are whitelisted for withdrawal.
0xDC51…A778 on explorer.optimism.io
0xDC51…A778 explorer · Sourcify · block 157880645 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The Vault owner key is a Turnkey signer reached through ether.fi app login.
etherfi.gitbook.io/etherfi/products/cash/vault
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Secrets and webhook handling

Are secrets kept out of client bundles and are webhooks signed and verified? S5

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Audits and bug bounty

Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Audits are pinned to commits and name per-finding fix commits; a live bounty exists. Two things are missing for 3: the bounty scope is not in the repo, and the deployed implementations (Oct 2026) are far past the audited commits, with later modules covered by separate reports I did not map one by one. Lower anchor taken = 2.

Evidence (3)2 verified · 1 documented

Verified
30 audit PDFs (Certora, Paladin, Nethermind). The Certora "Cash Module + Safe" report scopes cash-v3 PR 3 (45dc3ee to d6aa4845, final 12cbd745e029d1941f6f60b8e4ad9ff3d2528d4a) and names a fix commit per finding (e.g. 34546ae, ef608f4); the SettlementDispatcherV2 report cites fix commit 54150cc.
etherfi-protocol/cash-v3 · audit
commit a5024d0b6e · checked 2026-10-07
Verified
The fix commit cited for M-01 in the Cash Module + Safe audit exists in the repo, titled "fix hooks == address(0) case and CONFIGURE_MODULE_TYPEHASH to include moduleSetupData".
etherfi-protocol/cash-v3 · src
commit 34546ae113 · checked 2026-10-07
Documented
The docs point to an Immunefi bounty for the protocol's contracts. The bounty scope is not in the cash-v3 repo.
etherfi.gitbook.io/etherfi/security/security-and-risks/audits
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Security audits 29

Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.

Date	Auditor	Type	Scope	Covers deployed code	Findings
2026-09	Certora	Security review	Item 21: MidasLiquifierModule (src/modules/etherfi/MidasLiquifierModule.sol). at `8405b6ce` Initial commit 29350aaf. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	7 informational
2026-09	Certora	Security review	Item 22: TradingSafeLiquidDepositModule (mainnet Liquid deposit from the trading Safe). at `65bc80ec1` Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	1 informational
2026-08-04	Certora	Audit	EtherFi Lend: lend-gateway module and related contracts (cash-v3 PR 153 and the PR 261 follow-up); reviewed 2026-07-20 to 2026-08-04. Draft report as committed. Lend is the borrowing path card spends can draw on.	Unknown	1 medium, 8 low, 9 informational
2026-08	Certora	Security review	Item 17: role re-gating across modules (AcrossSwapModule, CashbackDispatcher, EtherFiDataProvider, DebtManagerAdmin, DebtManagerStorageContract, EnsoSwapModule and other modules). at `2aed606ac4` Initial commit 18f224a108. Report header dated August 2026; committed to cash-v3 on 2026-09-29.	Unknown	1 low, 8 informational
2026-08	Certora	Security review	Item 18: CashbackDistributor (src/cashback-distributor/CashbackDistributor.sol). at `0dda38da` Initial commit 0058252b. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	1 medium (awardStaked approves ETHFI to the wrong address), fixed
2026-08	Certora	Security review	Item 15: Safe WETH wrap and ERC-1271 support (SafeErc1271Lib, EtherFiSafe, EtherFiSafeErrors, MultiSig), the user Safe implementation. at `27385346` Initial commit 56719bb523. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	6 informational
2026-08	Certora	Security review	Item 16: Stargate taxi mode (StargateModule, SettlementDispatcherV2, StargateAdapter). at `02993649` Initial commit 3603a691. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	1 informational
2026-08	Certora	Security review	Item 14: wrapStocks in TopUp and TopUpFactory. at `db2a2113` Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	1 informational
2026-08	Certora	Security review	Item 11: CCTPModule (src/modules/cctp/CCTPModule.sol). at `dd7b4cac74` Initial commit ccb8fe30f3. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	7 informational
2026-08	Certora	Security review	Item 13: stock wrap on top-up redirect (TopUp, TopUpFactory). at `aa27177e` Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	1 informational
2026-08	Certora	Security review	Item 10: StockWithdrawModule, StockUnwrapper and StockOFTBridgeAdapter. at `17ccfc063` Initial commit 0b4c8da3f. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	6 informational
2026-08	Certora	Security review	Item 8: TradingSafeWithdrawModule. at `72d0ae3e14` Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	2 informational
2026-08	Certora	Security review	Item 9: EnsoSwapModule. at `90e68688` Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	1 informational
2026-07-28	Paladin	Audit	Aave v4 price feeds: BaseAaveV4PriceFeed, StablePriceLib, ChainlinkPriceFeed, PythPriceFeed, VedaAccountantPriceFeed and OracleSinkPriceFeed on Optimism. at `3c932071c6` Resolution commit ac70926. The report marks the Chainlink, Pyth and Veda feeds as matching live code on Optimism; OracleSinkPriceFeed was not deployed. We did not re-check the live bytecode.	Yes	5 informational: 2 resolved, 1 partly resolved, 2 acknowledged
2026-07	Certora	Security review	Item 6: Trade and Hold (EtherFiDataProvider, AcrossSwapModule, EnsoSwapModule, OwnershipBridge sender, receiver and library, EtherFiSafe and related contracts). at `ac86bd70eb` Initial commit edba2b91. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	7 medium, 7 low and informational findings
2026-06	Certora	Security review	Items 3 and 4: SafeAssetRecoveryModule and its deploy script (cash-v3 PRs 132 and 136). at `f907a44c76` Initial commit 93ff2389. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	1 medium (fixed), 1 low, 4 informational
2026-06	Certora	Security review	Item 2: SCR swap and SCRRecoveryModule. at `db245879` Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3.	Unknown	3 informational
2026-02	Certora	Security review	Item 9: SettlementDispatcherV2 (Frax redemption to USDC), the card settlement dispatcher. at `54150cc` Initial commit e24c1c2. We did not check whether the SettlementDispatcherRain and Reap implementations on OP Mainnet were built from 54150cc.	Unknown	7 informational
2025-11-28	Certora	Security review	Cash Module combined report (bundle 11): Pix wallet auto top-up and SettlementDispatcherV2. at `a643d24f2` Reviewed 2025-11-16 to 2025-11-28; SettlementDispatcherV2 at 6efc2b47d. Draft report as committed.	Unknown	3 informational (2 fixed)
2025-11-07	Certora	Security review	beHYPE bridging contracts combined report (bundle 9): BeHYPE Scroll Staker and the BeHYPE staking module in cash-v3. at `bdfb44f` Reviewed 2025-10-31 to 2025-11-07 across the cash-v3 and beHYPE repos. Staking module, not the card spend path.	Unknown	3 high, 1 medium, 3 low, 2 informational; 8 of 9 fixed
2025-10-08	Certora	Security review	Bridging contracts combined report: weETH OFT role changes, beHYPE OFT contracts and the CCTP adapter in cash-v3. Reviewed 2025-10-06 to 2025-10-08; only the CCTP adapter is cash-v3 code (commits 76f0ad to 3545ec, as abbreviated in the report).	Unknown	1 informational, fixed
2025-08	Certora	Audit	Canonical bridge support in cash-v3 (module-requested bridging through CashModule withdrawals). at `a9abc18384` The report is undated in the extracted text; the date is when it was committed (2025-08-08).	Unknown	2 high, 1 medium, 1 low, 4 informational
2025-06	Certora	Audit	Cash Module combined report, April-June 2025: Liquid minting and staking module, default module changes, top-up indexing, multi spend and referrals, WETH top-ups, multiple settlement dispatchers, Stargate bridge module, Aave module, NTT bridge adapter and later items. The report's scope table gives no commit hashes. Draft report as committed (2025-06-24).	Unknown	Per-section findings up to high severity (one H-01 among the sections)
2025-03-26	Certora	Audit	Safe Recovery Manager (cash-v3 PR 5): recovery feature added to the Safe, EtherFiDataProvider, EtherFiHook, IEtherFiSafe, IModule, OpenOceanSwapModule and related contracts. at `df6d6c59` Audit start 2b37e643, last reviewed 6bc9436. The recovery code is in the deployed Safe lineage, but the deployed implementations are far past this commit (S6).	Partly	1 critical (single Safe admin can drain the Safe), 4 medium; all fixed
2025-03-20	Certora	Audit	Cash Module + Safe (cash-v3 PR 3): BeaconFactory, CashbackDispatcher, EtherFiDataProvider, DebtManager, CashModule, EtherFiSafe, EtherFiHook, settlement dispatcher and related core contracts. at `d6aa4845` Audit start 45dc3ee, final 12cbd745. This is the core of the deployed system, but the OP Mainnet implementations (Oct 2026) are far past the audited commit (S6).	Partly	2 critical, 2 high, 6 medium, 6 low; 14 of 16 fixed, each with a fix commit
2025-03-03	Certora	Audit	EtherFi TopUp contracts in cash-v2 (src/*, excluding mocks and the bridge adapters). at `c0ae4e5d28` Reviewed 2025-02-24 to 2025-03-03 on the cash-v2 dev branch; the top-up contracts later moved into cash-v3.	Unknown	1 medium (CREATE3 on zkSync, unconfirmed), 3 low, 7 informational
2024-12-13	Nethermind	Security review	NM-0394 EtherFi Cashback: UserSafe, L2DebtManager and CashbackDispatcher in the earlier Cash contracts (Scroll). The file is named NM_0289 but the report is NM-0394. Covers the pre-cash-v3 contracts, replaced by the cash-v3 Safes on OP Mainnet.	No	1 high, 1 medium, 7 low, 7 informational, 5 best practices; 12 fixed, 9 acknowledged, 1 unresolved
2024-11-21	Nethermind	Security review	NM-0381 EtherFi CashSafe top-up mechanism and UserSafe spending-limit changes in the earlier Cash contracts. Covers the pre-cash-v3 contracts.	No	6 low, 4 informational, 1 best practices; 6 fixed, 5 acknowledged
2024-09-23	Nethermind	Security review	NM-0289 EtherFi Cash: UserSafe funds management and L2DebtManager loans in the earlier Cash contracts. Initial report 2024-09-18. Covers the pre-cash-v3 contracts.	No	5 critical, 2 high, 11 medium, 7 low, 11 informational, 2 best practices; 25 fixed, 6 acknowledged, 4 mitigated, 3 unresolved

Compiled from: The audit/ folder of github.com/etherfi-protocol/cash-v3 at a5024d0 (26 PDFs: Certora and Paladin; the etherfi-protocol/cash-v2 repo holds the same set), the audits/ folder of the earlier etherfi-protocol/cash-contracts repo (Nethermind and Zellic), and ether.fi's audits page (etherfi.gitbook.io/etherfi/security/security-and-risks/audits), which points to the cash-v3 registry. The Zellic "Cash contracts Pre-order Update" draft (Sep 2024) covers the card pre-order NFT contract, not the payment path, so it is not listed. Staking-protocol audits (etherfi-protocol/smart-contracts) are out of scope. The Immunefi bug bounty is not an audit. Many Certora item reports are marked draft or internal in the committed PDF. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.

Operational and procurement

Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.

Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 21 evidenced, 0 attested, 5 absent, 0 not applicable, 19 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.

Group A: operational facts

Fees

Evidenced

Component	Paid by	Amount	Basis
fx	payer	1% base plus up to 0.5% (Core) or up to 0.25% (Luxe); no added margin for Pinnacle and VIP	International cardholder agreement section 10 (fee schedule dated 5 Feb 2026) and help-centre limits page; ether.fi may change fees on 30 days' notice.
card	payer	10 USD for the first virtual card in 14 listed countries; otherwise one free virtual card for Core	Help-centre regional pricing article; shown in the app before ordering.
cashout	payer	Bank withdrawal: USD ACH 0.50 USD + 0.20%, Fedwire 20 USD + 0.20%, SWIFT 20 USD + 0.12%, EUR SEPA 0.90 EUR + FX	Help-centre bank transfer FAQ; other payout routes are quoted in the app before confirmation.
limit	payer	ATM 1,000 USD per withdrawal, at most 5 per rolling 24 h; ATM fee not stated	Help-centre limits page. The membership page lists ATM withdrawals as free up to 10 per month for Pinnacle and VIP only.

No issuance, monthly or annual fee is stated for Core; membership levels above Core are unlocked by loyalty points (Luxe 5K, Pinnacle 25K) or invitation. The U.S. cardholder agreements reserve an annual fee and a foreign transaction fee whose amounts sit in Account Opening Disclosures that are not public. Judgment call: first-party help-centre pricing pages are treated as documented for fees here, while the CROPS seed cited the same help centre as claimed.

Documented
Cardholder Agreement - Inc. (International), section 10 Foreign Currency Transactions.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Help-centre article on limits and fees per membership level (ATM limits, added FX margin table).
help.ether.fi/en/articles/303623-what-are-the-transaction-limits-and-fees-for-personal-cash-credit-cards
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
Documented
Help-centre article listing the 14 countries where the first virtual card costs 10 USD.
help.ether.fi/en/articles/833743-why-is-there-a-10-fee-for-my-first-virtual-cash-card
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Bank transfers FAQ, funding fee table and outgoing USD bank-transfer fee table.
help.ether.fi/en/articles/758758-bank-transfers-faqs
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Custody model

Evidenced

Hybrid: self-custody with a provider-controlled spend path

Funds rest in the user's beacon-proxy Safe (owner key in a Turnkey enclave); card spends move to an ether.fi-controlled, upgradeable settlement dispatcher that the 8 h timelock can redirect, and ether.fi plus a third party can recover a Safe after 3 days unless the owner cancels. Agrees with the S1 finding (score 1).

Evidence shared with CROPS: S1 item 1, S1 item 2, S1 item 3

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Licences and registrations

Unknown

The cardholder agreements name Third National as issuer under a Visa licence and choose Puerto Rico law, but no first-party document states Third National's regulator, licence type or number. The FDIC BankFind API lists no active institution named Third National (only closed Tennessee banks), which suggests it is not a US insured bank; the Puerto Rico OCIF licence verification site (concesionarios.ocif.pr.gov) failed the TLS handshake from this environment, so the register could not be checked. The provider file context mentions BANEX Microfinance Bank (Nigeria) without a first-party source. ether.fi's risks page says ether.fi itself is not a regulated financial institution.

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Cash-out options

Evidenced

Where	Method	Partner	Fee	Limits
everywhere offered	card withdrawal	Third National (issuer), Visa	FX 1% plus tier margin on non-USD spend	Card spend at merchants (the schema has no card-spend value); limits set by ether.fi and the issuer.
everywhere offered	atm	Third National (issuer), Visa	not stated for Core and Luxe; free up to 10 per month for Pinnacle and VIP	1,000 USD per withdrawal, 5 per rolling 24 h; not allowed in North Korea, Iran, Myanmar
everywhere offered	bank transfer	unnamed banking provider	USD ACH 0.50 USD + 0.20%; SWIFT 20 USD + 0.12%; SEPA 0.90 EUR + FX; others quoted in app	Rails per currency: USD ACH/Fedwire/SWIFT, EUR SEPA, GBP FPS, BRL PIX, INR UPI, ~25 local routes. Excluded in 24 jurisdictions (no card country); Puerto Rico not listed.

Contradiction: the international card terms say cash advances are not available, while the help centre lists ATM withdrawal limits per membership level and the U.S. agreements treat ATM use as a Cash Advance where enabled. Recorded as listed by the help centre; a reviewer should confirm ATM access outside the US.

Documented
Cardholder Agreement - Inc. (International), sections 2 and 6; also says cash advances are not available under the international card terms.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Help-centre limits page, ATM withdrawal limits and FATF-country exclusions.
help.ether.fi/en/articles/303623-what-are-the-transaction-limits-and-fees-for-personal-cash-credit-cards
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
Documented
Supported payout methods by currency.
help.ether.fi/en/articles/759961-supported-payment-methods-deposits-withdrawals
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
The 24 jurisdictions where bank transfers are not available.
help.ether.fi/en/articles/860027-in-which-countries-are-bank-transfers-not-available
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

First deployment

Evidenced

2026-03-27 (block 149521158): CashModule proxy 0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0 on Optimism (core chain since the April 2026 account upgrade)

This dates the current core-chain deployment only. ether.fi Cash ran earlier on Scroll (same CashModule address in cash-v3 deployments/mainnet/534352, and before that the archived cash-contracts repo); those earlier deployments were not dated here.

Verified
Creation tx 0x96728edf...f240 via deployer factory 0x59B5c9c09327b3Ed6a801BD035eA970f7a28b7ed; the CashModule proxy has code size 0 at block 149521157 and 122 bytes at 149521158 (timestamp 1774641093, 2026-03-27 19:51:33 UTC).
0x7Ca0…45F0 on explorer.optimism.io
0x7Ca0…45F0 explorer · Sourcify · block 149521158 · checked 2026-10-09

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Operating entity

Evidenced

Ether.Fi SEZC, KY

The card programme is contracted through Ether.Fi Cash Inc. or Ether.Fi Cash Ltd. (cardholder agreements), whose jurisdictions are not stated. No company-register entry was checked (the Cayman General Registry has no free public search).

Documented
Terms of Use section 1(a) names Ether.Fi SEZC, a Cayman Islands special economic zone company; the Privacy Policy gives its address at Strathvale House, George Town.
etherfi.gitbook.io/etherfi/legal/ether.fi-legal/terms-of-use
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Security incidents

Evidenced

Absence of a found incident is not evidence that none occurred.

Searched ether.fi's incident log (three entries), the Risks page and the S6 audit evidence. None of the logged incidents affected Cash funds: the Sep 2026 AtomicQueue exploit excluded Cash accounts, the Apr 2026 Kelp rsETH fallout paused Liquid vaults only, and the domain account takeover attempt (dated 'Sep 24' with no year on the page) caused no loss.

Documented
The 11 Sep 2026 legacy AtomicQueue exploit hit Liquid token holders; the post-mortem states Cash accounts were not exploitable.
etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/sep-11-incident-legacy-atomicqueue-exploit
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Product changes affecting users

Evidenced

2026-04-01: Account upgrade: the Cash core chain moves from Scroll to Optimism; a Safe is deployed for each user on Optimism and Scroll becomes a top-up chain. The page says April 2026 without a day; the date here is the month. source

Documented
Account upgrade page.
etherfi.gitbook.io/etherfi/products/cash/account-upgrade
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Volume transacted (verified only)

Unknown

not computed on 2026-10-19: eth_getLogs: backend response too large

Card spends are recorded as Spend events by the listed CashEventEmitter, so they can be separated from ordinary transfers. Not yet computed; the maintainer runs scripts/volumes.mjs.

UnreviewedAssessed by AI research agent (operational), 2026-10-09

Group B: institutional due diligence

Control	State	What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?	Unknown	No ISO 27001 statement for ether.fi (Ether.Fi SEZC or Ether.Fi Cash Inc./Ltd.) found in the GitBook docs (full-text llms-full.txt), Security & Risks section, Terms of Use or Privacy Policy. The only ISO 27001 mentions are for third-party staking node operators. Issuer Third National not checked.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?	Unknown	No hosting or support organisation certification found; the docs do not name the hosting provider for the Cash app or backend.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?	Unknown	No SOC 2 or ISAE report or statement of availability found for ether.fi; the SOC 2 mentions in the docs concern staking node operators.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?	Evidenced	Smart-contract audits (Certora, Paladin, Nethermind) pinned to cash-v3 commits with per-finding fix commits, plus an Immunefi bounty. No independent review of the closed app, card backend or Turnkey integration was found. Cross-reference CROPS S6 (score 2). The audits cover contracts only. CROPS S6 · CROPS S6
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?	Unknown	No penetration-test report or attestation found for the Cash app, web app or backend.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?	Unknown	The incident playbook describes 24/7 onchain monitoring by Hypernative, not vulnerability scanning of the platform or application; no scanning cadence is stated.
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?	Absent	none of 1 repo(s): etherfi-protocol/cash-v3 ✗ no security policy file source 1
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?	Unknown	The incident playbook sets containment and signer-replacement SLAs (containment within 1 h for SEV-1, compromised signer replaced within 24 h) but no patch timelines for known vulnerabilities.
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?	Absent	none of 1 repo(s): etherfi-protocol/cash-v3 ✗ no scanning config or workflow step found source 1
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?	Evidenced	Published playbook commits to an initial public acknowledgment within 4 hours of a confirmed SEV-1 (active or imminent loss of user funds) and status updates until resolution. No per-customer notification period for data incidents is stated in the Privacy Policy or cardholder agreements. source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?	Unknown	No statement on backups or restore testing for cardholder records found.
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?	Evidenced	Published incident response playbook (since Nov 2024, revised July 2026) with runbooks for contract exploit, key compromise, signer loss, oracle and bridge anomalies. It covers the contracts and frontends; no recovery plan for the card backend or card programme is published. For the non-custodial part see CROPS S4. The playbook is not stated to be tested; testing is not evidenced. source 1 CROPS S4
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?	Evidenced	Public incident log with post-mortems (domain account takeover attempt, Kelp rsETH fallout Apr 2026, legacy AtomicQueue exploit Sep 2026); the playbook commits to a post-mortem for every SEV-1 and SEV-2. No public status page found. source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?	Evidenced	Sign-in and approvals use a device passkey with no password; email one-time codes are used for account actions such as deletion. Whether a passkey is mandatory for every account is not stated; the MCP connector page says some accounts may have no passkey yet. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?	Evidenced	Stated only for key platforms after the 2024 domain incident (hardware authentication required); no general statement on privileged-access MFA or separate admin accounts. source 1
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?	Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?	Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?	Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?	Evidenced	The only documented API surface is the read-only MCP connector (mcp.ether.fi), which uses OAuth 2.1 with PKCE and passkey consent. The app's own browser-to-server API is not documented. source 1
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?	Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?	Evidenced	MCP connector access tokens last one hour; the grant (refresh) lasts 90 days and can be revoked, with access re-checked on every read. source 1
B5.4 Export controls If an API exports data, does it limit volumes and log exports?	Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?	Evidenced	Privacy Policy states encryption of sensitive personal information among its security measures; no data classification scheme or TLS version is stated. source 1
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?	Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?	Evidenced	Data kept as long as necessary for the purpose and as legally required; after account termination the user has 30 days to remove data before the account is deleted, and data may be retained after deletion for legal, tax or regulatory reasons. Self-service account deletion has a 14-day waiting period. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?	Evidenced	Controller is Ether.Fi SEZC (Cayman Islands), with an EU representative (Instant EU GDPR Representative Ltd.) and a UK representative (GDPR Local Ltd.). No DPIA is mentioned. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?	Unknown	The Privacy Policy says ether.fi enters into data processing agreements and standard contractual clauses for EEA/UK/Swiss/Brazil transfers, but no customer-facing DPA or statement that one is available to customers was found. The corporate agreement (international) was not read.
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?	Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?	Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?	Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?	Absent	none of 1 repo(s): etherfi-protocol/cash-v3 ✗ no deployment configuration source 1
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?	Evidenced	all of 1 repo(s): etherfi-protocol/cash-v3 ✓ rules: copilot_code_review, pull_request, deletion, non_fast_forward, non_fast_forward source 1
B9.2 CI runs on pull requests Does every pull request trigger automated checks?	Evidenced	all of 1 repo(s): etherfi-protocol/cash-v3 ✓ 3 workflow file(s) source 1
B9.3 Tests run in CI Do the CI workflows run the test suite?	Evidenced	all of 1 repo(s): etherfi-protocol/cash-v3 ✓ test command in a workflow source 1
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?	Absent	none of 1 repo(s): etherfi-protocol/cash-v3 ✗ coverage tooling referenced source 1
B9.5 Versioned releases Are releases tagged with immutable semantic versions?	Evidenced	all of 1 repo(s): etherfi-protocol/cash-v3 ✓ latest tags: v3.0.0 source 1
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?	Evidenced	all of 1 repo(s): etherfi-protocol/cash-v3 ✓ 10 of 10 recent commits signed source 1
B9.7 Changelog Is a changelog maintained with the code?	Evidenced	all of 1 repo(s): etherfi-protocol/cash-v3 ✓ 1 release(s) with notes source 1
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?	Absent	none of 1 repo(s): etherfi-protocol/cash-v3 ✗ none found source 1
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?	Evidenced	Cash Technical Documentation and Cash Modules pages cover the logical architecture (Vault, modules, hooks, roles) and integration (universal cross-chain addresses, Turnkey enclave, bridges). No infrastructure view of the closed backend. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?	Evidenced	Three parties: Ether.Fi SEZC (Cayman Islands special economic zone company) under the Terms of Use; Ether.Fi Cash Inc. or Ether.Fi Cash Ltd. as programme manager under the cardholder agreements; and the issuer Third National. Cardholder agreements are governed by Puerto Rico law. No company-register entry was checked; the Cayman register is not publicly searchable without an account, and the jurisdiction of Ether.Fi Cash Inc. and Ether.Fi Cash Ltd. is not stated in the documents. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?	Unknown implied from the component list
B11.3 Termination terms What happens to customer funds and data on termination by either side?	Evidenced	Either side may terminate the card terms on 30 days' notice; ether.fi and the issuer may also suspend or cancel at any time with or without notice. Amounts owed survive termination; prepaid subscriptions are refunded pro rata unless termination follows a breach. Funds in the Vault stay in the user's Safe (see CROPS S4). source 1
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?	Evidenced	No statement that AI decides card authorisations or screening. The Privacy Policy allows machine-learning use of personal data for research and product development and lists device fingerprinting and behavioural biometrics for fraud prevention; a read-only AI connector (MCP) can read account data but has no write path. Whether the fraud-prevention signals feed an automated model is not stated. source 1 · source 2
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?	Unknown implied from the component list

Scope of assessment

Components in the payment path

Component	Role	Public	Licence	Operator	Required
cash-v3 contracts (Safe, CashModule, modules, dispatchers)	contracts	Yes	none	ether.fi (upgradeable via 2-day timelock)	Yes
ether.fi app and web app (Cash tab)	frontend	No	proprietary	ether.fi	Yes
ether.fi card authorisation backend (ETHER_FI_WALLET_ROLE EOAs)	backend	No	proprietary	ether.fi	Yes
Turnkey owner-key enclave (user signer)	signer	No	proprietary	Turnkey	Yes
Settlement bridger (SETTLEMENT_DISPATCHER_BRIDGER_ROLE)	relayer	No	proprietary	ether.fi	Yes
Rain / Reap card programme (BIN sponsors named in code)	other	No	proprietary	Rain, Reap	Yes
Third National (card issuer per cardholder agreements)	card-issuer	No	proprietary	Third National	Yes
Visa card network	card-network	No	proprietary	Visa	Yes
KYC vendor (not named in any policy found)	kyc	No	proprietary	undisclosed	Yes
Price oracles (Chainlink and others in config)	oracle	Yes	proprietary	Chainlink and others	No
Aave v4 lend market (credit mode)	contracts	Yes	source-available	ether.fi deployment of Aave v4	No
Settlement tokens (USDC by Circle, USDT, EURC)	contracts	Yes	proprietary	Circle, Tether	Yes

Repositories

Repository	Role	License
etherfi-protocol/cash-v3	contracts	none
etherfi-protocol/cash-v3/tree/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/scripts	deploy	none

Contracts

Role	Address	Source verified
CashModule (UUPS proxy; spend, withdraw)	`0x7Ca0…45F0` explorer · Sourcify	sourcify
RoleRegistry (UUPS proxy; all roles)	`0x5C1E…687B` explorer · Sourcify	sourcify
EtherFiSafeFactory (UUPS proxy; owns Safe beacon)	`0xF4e1…d8CF` explorer · Sourcify	sourcify
UpgradeableBeacon for all user Safes	`0x48e1…D1ec` explorer · Sourcify	sourcify
EtherFiSafe implementation (beacon target)	`0x79A6…397e` explorer · Sourcify	sourcify
EtherFiDataProvider (default modules, recovery signers)	`0xDC51…A778` explorer · Sourcify	sourcify
EtherFiHook (pre/post module hook)	`0x5D3c…11b3` explorer · Sourcify	sourcify
SettlementDispatcherRain (card settlement)	`0x50A2…501C` explorer · Sourcify	sourcify
SettlementDispatcherReap (card settlement)	`0x9623…1Db2` explorer · Sourcify	sourcify
DebtManager (legacy credit; impl explorer-only)	`0x0078…9553` explorer · Sourcify	explorer
CashEventEmitter (impl explorer-only)	`0x380B…1acB` explorer · Sourcify	explorer
Upgrade timelock (2 days), RoleRegistry owner	`0x9106…4434` explorer · Sourcify	sourcify
Operating timelock (8 h), ADMIN_TIMELOCK_ROLE	`0x9AEb…7849` explorer · Sourcify	explorer
Cash governance Safe (3-of-6), ADMIN_ROLE	`0xA6cf…AAC4` explorer · Sourcify	explorer
Sample user Safe (beacon proxy)	`0x1DcE…3e76` explorer · Sourcify	none

Assessor notes

Scored the Optimism core-chain deployment from cash-v3 at a5024d0 (2026-10-05); onchain reads are pinned to OP block 157880645, with a sample spend at 157880145. www.ether.fi sits behind a Vercel bot checkpoint (HTTP 429 to curl), so website and legal citations use ether.fi's GitBook (etherfi.gitbook.io), which serves the same Terms, Privacy Policy and cardholder agreements. The ether.fi app, card backend and Turnkey integration are closed, so P5 and S5 are unknown.

At a glance

Holds up 5

Falls short 15

Not yet evidenced 3

Where it is offered

Settlement token

What would raise this pillar

What would raise this pillar

What would raise this pillar

What would raise this pillar

What would raise this pillar

Security audits 29

Group A: operational facts

Group B: institutional due diligence

Scope of assessment

Components in the payment path

Repositories

Contracts

Assessor notes