Root + Impact

Description

• Describe the normal behavior in one or more sentences

• "beforeInitialize" compares currency1 twice

• 
  

• Root == function _isReFiBuy(PoolKey calldata key, bool zeroForOne) internal view returns (bool) {
  bool IsReFiCurrency0 = Currency.unwrap(key.currency0) == ReFi; The function returns the wrong boolean for buy/sell detection.

• Impact == That inverts buy/sell logic and will apply the wrong fee directionally.Wrong direction ⇒ you charge buy fee on sells and vice versa — money lost / incentives inverted.

  if (IsReFiCurrency0) {

  //@> The func returns ZeroforOne instead of !zeroForone

  return zeroForOne;

  } else {

  return !zeroForOne;

  }

  }

Risk

Likelihood:

• Reason 1 // The first currency (currency0) is never checked, so the pool could contain ReFi in currency0 and this will still revert.

• Reason 2 // If ReFi is currency0, zeroForOne == true means swapping token0→token1 (selling token0), but your code returns zeroForOne and marks it as a buy.

Impact:

• Impact 1 The if statement to check the currency before it initializes won't check the first currency (currency0)

• Impact 2 Wrong direction => you charge buy fee on sells and vice versa -money lost/incentives inverted

Proof of Concept

1. The code decides zeroForOne / “direction” incorrectly (or incompletely) because it doesn’t check which slot (token0/token1) ReFi occupies; that can lead to charging a buy fee on a sell or vice-versa.

2. The first currency is not checked so the pool could contain ReFi in currency0 a nd will still revert.

   Correct approach

   ~Read token0 and token1 from the pool.

   ~Decide the direction with a direct comparison to the token the trader supplied (tokenIn or whatever your handler has).

   ~Given zeroForOne (true = token0→token1), classify sellRefi / buyRefi by checking which pool slot ReFi occupies

Recommended Mitigation

1. To eliminate the incorrect fee direction and ensure the hook always applies the correct buy/sell logic regardless of whether ReFi is currency0 or currency1, add an explicit helper that determines whether the swap represents a ReFi buy.

2. for the second bug, the function _isRefiBuy currently misidentifies swap direction by returning zeroForOne when Refi is currency0. This inverts buy/sell classification. If unaddressed, the protocol will apply incorrect fees, reward the wrong side of trades and expose itself to arbitrage and sandwich attacts. Replace the function with the corrected version that returns !zeroForOne when Refi is currency0 to ensure proper buy detection.