add ownership to MVF

contracts/tokenbridge/ethereum/L1AtomicTokenBridgeCreator.sol

@@ -270,6 +270,7 @@ contract L1AtomicTokenBridgeCreator is Initializable, OwnableUpgradeable {
                     address(l1Templates.masterVaultFactory),
                     proxyAdmin
                 );
+                MasterVaultFactory(l1Deployment.masterVaultFactory).initialize(upgradeExecutor);
             }
 
             // l1 router deployment block

contracts/tokenbridge/libraries/vault/MasterVault.sol

@@ -9,6 +9,7 @@ import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import { IERC4626 } from "lib/forge-std/src/interfaces/IERC4626.sol";
 
 // todo: make this more like a 4626 vault, erc20 shares + deposit + withdraw
+// todo: consider beacon proxy
 contract MasterVault is IMasterVault, Ownable {
     using SafeERC20 for IERC20;
 
@@ -32,7 +33,7 @@ contract MasterVault is IMasterVault, Ownable {
     }
 
     // todo: remove gateway and owner params
-    // factory can transfer ownership to upgrade executor
+    //       factory retains ownership. anyone can call deposit and withdraw since it's close to a standard 4626 vault
     constructor(address _token, address _gateway, address _owner) Ownable() {
         if (_token == address(0) || _gateway == address(0) || _owner == address(0)) {
             revert ZeroAddress();

contracts/tokenbridge/libraries/vault/MasterVaultFactory.sol

@@ -3,30 +3,33 @@
 pragma solidity ^0.8.0;
 
 import "@openzeppelin/contracts/utils/Create2.sol";
+import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 import "./IMasterVault.sol";
 import "./MasterVault.sol";
 
-contract MasterVaultFactory {
-    event VaultDeployed(address indexed token, address indexed gateway, address vault);
+contract MasterVaultFactory is OwnableUpgradeable {
+    event VaultDeployed(address indexed token, address indexed vault);
+    event SubVaultSet(address indexed masterVault, address indexed subVault);
 
-    error VaultDeploymentFailed();
     error ZeroAddress();
 
+    function initialize(address _owner) public initializer {
+        _transferOwnership(_owner);
+    }
+
     function deployVault(address token) public returns (address vault) {
         if (token == address(0)) {
             revert ZeroAddress();
         }
 
-        address gateway = msg.sender;
-
         bytes memory bytecode = abi.encodePacked(
             type(MasterVault).creationCode,
             abi.encode(token)
         );
 
         vault = Create2.deploy(0, bytes32(0), bytecode);
 
-        emit VaultDeployed(token, gateway, vault);
+        emit VaultDeployed(token, vault);
     }
 
     function calculateVaultAddress(
@@ -47,4 +50,13 @@ contract MasterVaultFactory {
         }
         return vault;
     }
+
+    // todo: consider a method to enable bridge owner to transfer specific master vault ownership to new address
+    function setSubVault(
+        address masterVault,
+        address subVault
+    ) external onlyOwner {
+        IMasterVault(masterVault).setSubVault(subVault);
+        emit SubVaultSet(masterVault, subVault);
+    }
 }