Address to refund the tokens being bridged is incorrectly assigned and will cause users to lose their funds in case the bridge execution fails in the destination chain.
Audit: 2024-01-decent-findings
Severity: HIGH

# Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L101
https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L105


# Vulnerability details

## Impact
Users will lost all their bridged funds in case that the bridge execution fails in the destination chain.

## Proof of Concept
When a user is bridging tokens to perform an execution in the destination chain, the users initiates their transaction by:
1. Calling the [`UTB::bridgeAndExecute() function`](https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L259-L274), from there it will do the swap pre-bridge (in the src chain) & will modify the swapInstructions for the swap post-bridge (in the dest chain), then it will invoke the [`UTB::callBridge() function`](https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L282-L301)
2. In the [`UTB::callBridge() function`](https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L282-L301) some approvals are granted to the DecentBridgeAdapter contract, and then the execution is forwarded to the [`DecentBridgeAdapter::bridge() function`](https://github.com/code-423n4/2024-01-decent/blob/main/src/bridge_adapters/DecentBridgeAdapter.sol#L81-L125)
3. In the [`DecentBridgeAdapter::bridge() function`](https://github.com/code-423n4/2024-01-decent/blob/main/src/bridge_adapters/DecentBridgeAdapter.sol#L81-L125), some data is encoded and decoded to prepare the calldata for the bridge, and then the [`DecentEthRouter::bridgeWithPayload() function`]() is called.
4. When the execution reaches the [`DecentEthRouter::bridgeWithPayload() function`](https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L197-L215), **notice how the `msg.sender` in the DecentEthRouter contract will be the DecentBridgeAdapter contract**, (from step 3 to step 4, the caller is the DecentBridgeAdapter contract). When the `payload` that is sent for the execution in the destination chain is defined in the [`DecentEthRouter::_getCallParams() function`](https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L80-L111), which is called by the [`DecentEthRouter::_bridgeWithPayload() function`](https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L148-L194), the second parameter that is encoded as part of the `payload` variable it is set to be the `msg.sender`, keep in mind that the **`msg.sender` is the address of the DecentBridgeAdapter**, ***not the user's address or an address controlled by him.***
5. **From here onwards, the execution is sent to LayerZero, which will send the `payload` variable to the [`DecentEthRouter::onOFTReceived()` function]() in the destination chain**.

![Steps 1 to 5 of the execution flow](https://res.cloudinary.com/djt3zbrr3/image/