Attackers can use `reclaimContract()` to transfer assets in protocol to address(0)
`reclaimContract()` would transfer payment tokens to `bulls[contractId]`. An attacker can make `reclaimContract()` transfer assets to address(0).\\nAn attacker can use a fake order to trick `reclaimContract()`. The fake order needs to meet the following requirements:\\n`block.timestamp > order.expiry`.\\n`!settledContracts[contractId]`.\\n`!reclaimedContracts[contractId],`.\\nThe first one is easy to fulfilled, an attacker can decide the content of the fake order. And the others are all satisfied since the fake order couldn't be settled or reclaimed before.\\n```\\n    function reclaimContract(Order calldata order) public nonReentrant {\\n        bytes32 orderHash = hashOrder(order);\\n\\n        // ContractId\\n        uint contractId = uint(orderHash);\\n\\n        address bull = bulls[contractId];\\n\\n        // Check that the contract is expired\\n        require(block.timestamp > order.expiry, "NOT_EXPIRED_CONTRACT");\\n\\n        // Check that the contract is not settled\\n        require(!settledContracts[contractId], "SETTLED_CONTRACT");\\n\\n        // Check that the contract is not reclaimed\\n        require(!reclaimedContracts[contractId], "RECLAIMED_CONTRACT");\\n\\n        uint bullAssetAmount = order.premium + order.collateral;\\n        if (bullAssetAmount > 0) {\\n            // Transfer payment tokens to the Bull\\n            IERC20(order.asset).safeTransfer(bull, bullAssetAmount);\\n        }\\n\\n        reclaimedContracts[contractId] = true;\\n\\n        emit ReclaimedContract(orderHash, order);\\n    }\\n```\\n
There are multiple solutions for this problem.\\ncheck `bulls[contractId] != address(0)`\\ncheck the order is matched `matchedOrders[contractId].maker != address(0)`
An attacker can use this vulnerability to transfer assets from BvB to address(0). It results in serious loss of funds.
```\\n    function reclaimContract(Order calldata order) public nonReentrant {\\n        bytes32 orderHash = hashOrder(order);\\n\\n        // ContractId\\n        uint contractId = uint(orderHash);\\n\\n        address bull = bulls[contractId];\\n\\n        // Check that the contract is expired\\n        require(block.timestamp > order.expiry, "NOT_EXPIRED_CONTRACT");\\n\\n        // Check that the contract is not settled\\n        require(!settledContracts[contractId], "SETTLED_CONTRACT");\\n\\n        // Check that the contract is not reclaimed\\n        require(!reclaimedContracts[contractId], "RECLAIMED_CONTRACT");\\n\\n        uint bullAssetAmount = order.premium + order.collateral;\\n        if (bullAssetAmount > 0) {\\n            // Transfer payment tokens to the Bull\\n            IERC20(order.asset).safeTransfer(bull, bullAssetAmount);\\n        }\\n\\n        reclaimedContracts[contractId] = true;\\n\\n        emit ReclaimedContract(orderHash, order);\\n    }\\n```\\n