# Redeeming a Settlement won't work for unsigned messages when the communicating dApps have different addresses on the different chains

MulticallRootRouter sets the branch-chain dApp recipient as settlement refundee, so failed settlements are unredeemable when that address doesn't exist on root chain, locking funds.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO
- Credited: alexxander
- Disclosed: 2023-11-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-maia-findings/issues/679
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** MulticallRootRouter.execute / RootBridgeAgent settlement creation
**Root cause:** _approveAndCallOut passes outputParams.recipient as both recipient and refundee; _createSettlement sets settlement.owner = _refundee, so redemption requires msg.sender to equal the branch-chain dApp address, which may not exist on the root chain.
**Steps:**
1. dApp A on branch chain at `0xbeef` calls `CallOut(...) 0x01` with `OutputParams(0x01)` targeting RootRouter.
2. RootBridgeAgent executor calls `MulticallRootRouter.execute()`, which performs arbitrary calls and receives OutputParams assets.
3. MulticallRootRouter calls `_approveAndCallOut(outputParams.recipient, outputParams.recipient, ...)`, creating a settlement with `owner = recipient = 0xbeef`.
4. Settlement fails; `redeemSettlement` requires `msg.sender == settlement.owner` or its virtual account, but `0xbeef` is unknown on root chain, so funds stay stuck.
**How found:** Code reading of MulticallRootRouter.execute and _createSettlement revealed recipient reused as refundee, then traced redeemSettlement ownership check to confirm funds lock.
**Insight:** When a cross-chain router reuses a destination-chain recipient as the settlement refundee/owner, check whether that address is resolvable on the source chain; mismatched dApp addresses across chains break redemption paths.