[H-1] Validation in _beforeInitialize() checks currency1 twice instead of checking both currencies, allowing pools without ReFi token to use the hook

Root + Impact

Description

The _beforeInitialize() function is designed to validate that the ReFi token exists in the pool as either currency0 or currency1 before pool initialization. The validation should check both currencies to ensure at least one matches the designated ReFi token address.

Due to a copy-paste error, the function checks currency1 twice instead of checking both currency0 and currency1. This allows pools that have ReFi as currency0 but not currency1 to bypass validation, and vice versa.

Risk

Likelihood:

• Any pool initialization where ReFi is currency0 will incorrectly pass validation even if currency1 is not ReFi

• The condition currency1 != ReFi && currency1 != ReFi is always equivalent to currency1 != ReFi, making the check incomplete

• Pool creators can initialize pools with arbitrary token pairs that don't include ReFi

Impact:

• Pools without the ReFi token can be initialized with this hook, breaking the fundamental protocol assumption

• The asymmetric fee logic (0% buy, 0.3% sell) will be incorrectly applied to non-ReFi token pairs

• Protocol revenue model is compromised as fees are collected on wrong tokens

• Users will be confused about which tokens are actually "ReFi" tokens

• The hook's core functionality of incentivizing ReFi token accumulation is defeated

Proof of Concept

A simple test in Solidity that shows the steps to reporduce in the real world

Recommended Mitigation

Using the correct Refi token, this would fix it immediately