fix(oracle): resolve top-up credentials through pod-or-node + regression test [re-review finding 1]

[0xpanicError]

Finding 1 (BLOCKER) — the production top-up builder stranded pod-less validators

The independent re-review at head 0101757 found that EtherFiAdmin._approveValidators — the production builder of the 31 ETH top-up deposit data, reached via executeValidatorApprovalTask — hardcoded getEigenPod(). For a pod-less node that is address(0), so it baked 0x02 + address(0) credentials whose deposit root can never match the node credentials fixed at creation. confirmAndFundBeaconValidators then reverts IncorrectBeaconRoot, and the validator is stranded at 1 ETH forever.

This is the only production path that funds a validator past 1 ETH, so the pod-less feature could not work as merged. EtherFiAdmin.sol was outside the original 15-file diff, which is why it was missed.

Fix (src/oracle/EtherFiAdmin.sol)

Resolve the credential target as pod-or-node — IEtherFiNode(node).getEigenPod(), else the node — mirroring StakingManager.confirmAndFundBeaconValidators. Resolved raw (not via withdrawalCredentialTarget) so a top-up is not blocked if the pod was retired between creation and approval (consistent with the earlier finding-4 scoping). Pod-backed nodes are unaffected: getEigenPod() returns the pod, the else branch is never taken, and the built root is byte-identical to before.

Test (test/behaviour-tests/oracle-podless-funding.t.sol)

Drives the real path — executeValidatorApprovalTask → _approveValidators → confirmAndFundBeaconValidators — for a pod-less validator and asserts it funds to full validator size, stays linked, and stays pod-less. The existing pod-less tests hand-build the top-up DepositData and prank the admin, skipping _approveValidators; this one lets the builder build it.

Non-vacuous, verified both directions:

• Passes against the fixed builder.
• Fails IncorrectBeaconRoot() when the fix is reverted (confirmed with forge build --force to defeat the incremental-build cache).

Notes

• Existing suites unaffected: lifecycle 54, prelude 42 green.
• Out of scope / follow-up (oracle repo): the off-chain daemon has a second, independent gate — validator_scanner.py computes expected credentials through getEigenPod and rejects pod-less validators with "Withdrawal credentials mismatch." That must be fixed in the oracle repo before pod-less validators can be approved in production. This PR only fixes the on-chain builder.
• Release ordering: oracle + EtherFiAdmin must land before/with the contract upgrade, never after.

Base: pankaj/feat/non-eigenpod-withdrawal-credentials (the #485 branch).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Note

Medium Risk
Touches the only on-chain path that builds validator top-up deposit data after oracle approval; incorrect credential logic would strand funds, but the change mirrors existing StakingManager behavior and is covered by a targeted regression test.

Overview
Fixes a blocker where pod-less validators could never complete oracle-driven funding past the initial 1 ETH deposit.

EtherFiAdmin._approveValidators no longer builds top-up deposit roots using getEigenPod() alone. It now uses the same pod-or-node rule as StakingManager.confirmAndFundBeaconValidators: EigenPod when present, otherwise the EtherFi node address. That keeps compounding withdrawal credentials aligned with what was fixed at validator creation, so confirmAndFundBeaconValidators no longer reverts IncorrectBeaconRoot. Pod-backed validators behave as before; the fallback only applies when the pod is address(0).

Adds oracle-podless-funding.t.sol, which runs the production path executeValidatorApprovalTask → _approveValidators → confirmAndFundBeaconValidators for a pod-less validator (including an in-place EtherFiAdmin impl swap on the fork) and asserts full-size funding without requiring hand-built deposit data.

^{Reviewed by Cursor Bugbot for commit c355f43. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.