RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong pool-token check in _beforeInitialize — ReFi presence test only checks currency1 twice

themo2

Root + Impact

Description

  • The _beforeInitialize hook in RebateFiHook.sol is intended to ensure the pool being created contains the ReFi token. The current implementation compares key.currency1 against the ReFi address twice and never checks key.currency0. As written, the function reverts only when currency1 is not ReFi; pools with ReFi as currency0 will be allowed but should be accepted, while pools with ReFi absent from both sides may incorrectly pass or fail depending on the duplicate check logic.

function _beforeInitialize(address, PoolKey calldata key, uint160) internal view override returns (bytes4) {
//@audit-issue logic error, should check both currencies
@> if (Currency.unwrap(key.currency1) != ReFi &&
Currency.unwrap(key.currency1) != ReFi) {
revert ReFiNotInPool();
}
return BaseHook.beforeInitialize.selector;
}

Risk

Likelihood:

  • During pool creation where ReFi has been supplied as currency0 rather than currency1 (common when callers supply token ordering in different conventions).

Impact:

  • pools that should be validated as containing ReFi may be mis-detected; conversely, some pools with ReFi might be rejected incorrectly based on the duplicated check. This leads to incorrect hook enforcement at pool initialization.


Recommended Mitigation

Replace the duplicated currency1 checks with checks of both currency0 and currency1.

function _beforeInitialize(address, PoolKey calldata key, uint160) internal view override returns (bytes4) {
-- if (Currency.unwrap(key.currency1) != ReFi && Currency.unwrap(key.currency1) != ReFi) {
++ if (Currency.unwrap(key.currency0) != ReFi && Currency.unwrap(key.currency1) != ReFi) {
revert ReFiNotInPool();
}
return BaseHook.beforeInitialize.selector;
}
Updates

Lead Judging Commences

chaossr Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Faulty pool check; only checks currency1 twice, omitting currency0.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!