Unchecked ecrecover

What is the bug in this signature check?

address public signer; // never set, still address(0)

function claim(bytes32 hash, uint8 v, bytes32 r, bytes32 s) external {
    require(ecrecover(hash, v, r, s) == signer, "bad sig");
    _payOut(msg.sender);
}