Root + Impact

Description

• Normal behavior: _beforeInitialize() should allow pool initialization when either currency0 or currency1 equals the ReFi token address.

• Issue: The code checks currency1 twice and never checks currency0, so pools where ReFi is currency0 will revert at initialization and cannot be created using this hook. This is a denial-of-service for legitimate pool creation and prevents the hook from being used as intended.

Risk

Likelihood:

• Risk1 - This will occur whenever the hook is used to initialize a pool where the ReFi token is supplied as currency0 (owner tries to initialize such pools).

• Risk2 - New deployments or test setups that place ReFi at currency0 will consistently hit this check and fail.

Impact:

• Impact 1 - Legitimate pool creation is blocked — owner cannot enable the hook on valid pools.

• Impact 2 - Disrupts testing and production deployment; may require code patch and redeployment, wasting time and possibly funds.

Proof of Concept - Consider adding a brief explanation that describes how your Proof-of-Concept triggers the issue.

Recommended Mitigation - Consider adding a short explanation that outlines why your proposed mitigation resolves the underlying problem.