Restrict transferAndRequestRedemption caller
By only allowing the VendingMachine to call this function,
we remove the possibility for this function to be used
maliciously by using  _finalRecipient == frt-owner
where the frt ower is not the actual redeemer
@@ -165,6 +165,10 @@ contract Deposit is DepositFactoryAuthority {
bytes memory _redeemerOutputScript,
address payable _finalRecipient
) public returns (bool) {
+ require(
+ msg.sender == self.vendingMachineAddress,
+ "Only the vendingMachine can call transferAndRequestRedemption"
+ );
self.transferAndRequestRedemption(
_outputValueBytes,
_redeemerOutputScript,
