Don't take the addresses on trust. Compute them.

A vault's addresses come from NEAR's MPC root keys, the Bearer contract's account and a path. Run the same math in your browser and check that nobody swapped in an address of their own.