The owner of deposit in the BranchBridgeAgent.sol can be different than the value of _refundee address

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L832
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L354

Vulnerability details

Impact

The transaction to the retryDeposit function can get reverted.

Proof of Concept

When the user call callOutAndBridge function, user can choose value of _refundee as the address to return excess gas deposited in msg.value to.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L210

The callOutAndBridge will call _createDeposit to move assets from branch chain to root and create deposit data for user. in the deposit data, contract is using _refundee value as owner of deposit transaction / data.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L832

Now if the user needs to retry the deposit transaction The deposit that is already created, the user should call retryDeposit function. in this function, first, contract check if deposit belongs to message sender. if MSG.SENDER is the owner of the deposit, it's ok, else the transaction will get reverted.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L354

Now in the callOutAndBridge, if the user uses another address as _refundee value, the owner of the deposit transaction will be another address, and the user is not able to use retryDeposit function for the deposit transaction in future.

Tools Used

Manually

Recommended Mitigation Steps

I think best option is to use msg.sender as the owner of deposit.
https://github.com/code-423n4/2023-05-maia/blob/1a95ffeaa057f14e6f317f7c3af84def2db16309/src/ulysses-omnichain/BranchBridgeAgent.sol#L264

Assessed type

Other

[c4-pre-sort]

0xA5DF marked the issue as duplicate of #858

[c4-pre-sort]

0xA5DF marked the issue as sufficient quality report

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a

[alcueca]

Documentation issue, the _refundee is actually the deposit owner if the caller decides that it should be anyone else.