Fix critical memory offset bug in FiatTokenUtil

[Kewe63]

Summary

Fix incorrect assembly memory offsets in _unpackAddresses that caused transferWithMultipleAuthorizations to decode wrong addresses, leading to failed or misdirected batch transfers.

Detail

In FiatTokenUtil.sol, the _unpackAddresses function uses inline assembly to extract two 20-byte addresses from a packed bytes memory parameter. The original code used offsets 20 and 40:

addr1 := mload(add(packed, 20))
addr2 := mload(add(packed, 40))

This is incorrect because Solidity stores bytes memory variables with a 32-byte length prefix in memory. Using offset 20 reads 12 bytes of the length field mixed with 20 bytes of the first address, producing a completely wrong value.

Correct offsets:

• addr1 at offset 32 (skip the 32-byte length prefix)
• addr2 at offset 52 (32 + 20 bytes of the first address)

This bug affected transferWithMultipleAuthorizations, the only external function that calls _unpackAddresses. Every batch transfer attempt would either revert or send tokens to incorrect addresses.

Testing

• Verify transferWithMultipleAuthorizations correctly decodes from and to addresses for a single transfer
• Verify transferWithMultipleAuthorizations correctly decodes addresses for multiple transfers in a single batch
• Verify addresses with leading zeros are decoded correctly
• Verify the function reverts with invalid signatures (not with wrong address decoding)

Documentation

No documentation changes required. This is an internal assembly-level fix with no changes to function signatures or external behavior.

---

Requested Reviewers: @Kewe63