RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect ReFi Token Validation Allows Initialization of Invalid Pools

smartshielder

Root + Impact

Description

  • _beforeInitialize should enforce that any pool initialized with this hook MUST include the ReFi token as either currency0 or currency1. This ensures the hook only runs on pools relevant to ReFi and prevents unintended behavior on unrelated pools.

  • Problem:
    The current implementation incorrectly checks currency1 twice and never checks currency0, leading to a broken invariant that allows initialization of pools that do not include the ReFi token at all.

// Root cause in the codebase with @> marks to highlight the relevant section
if (
@> Currency.unwrap(key.currency1) != ReFi &&
@> Currency.unwrap(key.currency1) != ReFi
) {
revert ReFiNotInPool();
}

Risk

Likelihood:

  • Pools are often initialized in automated scripts or via external integrators, causing this broken check to routinely allow pools without ReFi.

The hook applies dynamic fees and emits ReFi-specific events; when used on the wrong pool, execution paths depending on ReFi will misbehave or revert inconsistently during swaps.

Impact:

  • Non-ReFi pools can be initialized with this hook, enabling incorrect dynamic fee behavior and wrong event emission.

Downstream logic assuming the presence of ReFi may malfunction, leading to inconsistent state, unexpected reverts, or incorrect accounting.

Proof of Concept

A pool with tokens (ReFi, TokenB) (neither is ReFi) still initializes successfully:

PoolKey memory key = PoolKey({
currency0: ReFi,
currency1: Currency.wrap(address(TokenB)),
// …
});
​
vm.prank(admin);
hook.beforeInitialize(address(0), key, 0);
// ❌ Expected revert ReFiNotInPool()
// ✅ Initializes successfully due to incorrect check
​

Recommended Mitigation

Check both currencies explicitly:

// Root cause in the codebase with @> marks to highlight the relevant section
if (
@> Currency.unwrap(key.currency1) != ReFi &&
@> Currency.unwrap(key.currency1) != ReFi
) {
revert ReFiNotInPool();
}
- if (
- Currency.unwrap(key.currency1) != ReFi &&
- Currency.unwrap(key.currency1) != ReFi
- ) {
- revert ReFiNotInPool();
- }
+ if (
+ Currency.unwrap(key.currency0) != ReFi &&
+ Currency.unwrap(key.currency1) != ReFi
+ ) {
+ revert ReFiNotInPool();
+ }
​
Updates

Lead Judging Commences

chaossr Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Faulty pool check; only checks currency1 twice, omitting currency0.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!