contracts: Fix OZ-M-01 refund arguments

packages/contracts-bedrock/contracts/test/L2StandardBridge.t.sol

@@ -146,13 +146,12 @@ contract L2StandardBridge_Test is Bridge_Initializer {
     // - invalid deposit calls Withdrawer.initiateWithdrawal
     function test_finalizeDeposit_failsToCompleteOutboundTransfer() external {
         // TODO: events and calls
-        address invalidL2Token = address(0x1234);
-
         vm.mockCall(
             address(L2Bridge.messenger()),
             abi.encodeWithSelector(CrossDomainMessenger.xDomainMessageSender.selector),
             abi.encode(address(L2Bridge.otherBridge()))
         );
+        address invalidL2Token = address(0x1234);
         vm.prank(address(L2Messenger));
         vm.expectEmit(true, true, true, true);
         emit ERC20BridgeInitiated(
@@ -181,5 +180,21 @@ contract L2StandardBridge_Test is Bridge_Initializer {
             hex""
         );
     }
+
+    // finalizeBridgeERC20
+    // - fails when the local token's address equals bridge address
+    function test_ERC20BridgeFailed_whenLocalTokenIsBridge() external {
+        vm.mockCall(
+            address(L2Bridge.messenger()),
+            abi.encodeWithSelector(CrossDomainMessenger.xDomainMessageSender.selector),
+            abi.encode(address(L2Bridge.otherBridge()))
+        );
+        // fails when the local token's address equals bridge address
+        vm.expectEmit(true, true, true, true);
+        emit ERC20BridgeFailed(address(L2Bridge), address(L1Token), alice, bob, 100, hex"");
+
+        vm.prank(address(L2Messenger));
+        L2Bridge.finalizeDeposit(address(L1Token), address(L2Bridge), alice, bob, 100, hex"");
+    }
 }
 

packages/contracts-bedrock/contracts/universal/StandardBridge.sol

@@ -236,11 +236,13 @@ abstract contract StandardBridge {
         } catch {
             // Something went wrong during the bridging process, return to sender.
             // Can happen if a bridge UI specifies the wrong L2 token.
+            // We reverse both the local and remote token addresses, as well as the to and from
+            // addresses. This will preserve the accuracy of accounting based on emitted events.
             _initiateBridgeERC20Unchecked(
                 _localToken,
                 _remoteToken,
-                _from,
                 _to,
+                _from,
                 _amount,
                 0, // _minGasLimit, 0 is fine here
                 _data