Fun.xyz's legacy CheckoutPool contract on Polygon exposed a bridge() function without access control or recipient binding, allowing attackers to redirect execution into trusted settlement paths and drain funds to attacker-controlled accounts.