# Bull can `transferPosition()` to `address(0)` and the original order can be matched again

Bull transfers position to address(0), resetting the matched-order sentinel so the same order can be matched repeatedly, draining premium+fees from victims.

- Payout: Contest reward
- Severity: high
- Program: Bullvbear
- Credited: bin2chen
- Disclosed: 2022-11-05
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-11-bullvbear-judging/issues/114
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-bullvbear%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BvbProtocol matchOrder / transferPosition
**Root cause:** Matched state is inferred from bulls[orderHash] != address(0), but the bull can transfer the position to address(0), resetting the sentinel to the unmatched value.
**Steps:**
1. Bull creates/matches an order so bulls[uint(orderHash)] = bull address
2. Bull calls `transferPosition()` with recipient `address(0)`, setting bulls[uint(orderHash)] back to address(0)
3. Bear maker (or attacker) calls `matchOrder()` again on the same orderHash; `require(bulls[uint(orderHash)] == address(0), "ORDER_ALREADY_MATCHED")` passes
4. Repeat to pull `order.premium + bearFees` from victim wallet each iteration
**How found:** Code review of the matchOrder guard: noticed the matched check relies on a mapping value the bull itself can overwrite via transferPosition, making the sentinel attacker-controllable.
**Exploitation:** Attacker repeatedly re-matches the same order after zeroing the bulls mapping entry via transferPosition to address(0), extracting premium plus bear fees from the bear maker's wallet on every match.
**Insight:** When 'already processed' state is encoded as a non-zero address in a mapping the user can write to, check whether any user-reachable function (transfer, burn, renounce) can reset it to the zero sentinel; prefer a dedicated boolean/flag mapping.