bug found by auditors:

According to your bridge docs, withdrawer address have permission to withdraw on behalf of bridge address. It seems the Ics20Withdrawal action check if transaction sender is withdrawer address in check_stateful. But in execute, it decreases balance of sender from, which is not bridge address. This mean Ics20Withdrawal will try to decrease balance of withdrawer address

┆Issue Number: ENG-657