RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Pool Token Validation in `_beforeInitialize`

objectplayer

Root + Impact

The _beforeInitialize function checks key.currency1 twice instead of validating both currency0 and currency1, allowing pools without the ReFi token to bypass validation or incorrectly rejecting valid pools where ReFi is currency0.

Description

  • The hook is designed to only allow pools containing the ReFi token to be initialized with this hook, ensuring the fee logic applies correctly.

  • The validation contains a copy-paste error where key.currency1 is checked twice, completely ignoring key.currency0.

function _beforeInitialize(address, PoolKey calldata key, uint160) internal view override returns (bytes4) {
if (Currency.unwrap(key.currency1) != ReFi &&
@> Currency.unwrap(key.currency1) != ReFi) { // @> Should be key.currency0
revert ReFiNotInPool();
}
return BaseHook.beforeInitialize.selector;
}

Risk

Likelihood:

  • This occurs on every pool initialization attempt where ReFi is currency0

  • The condition currency1 != ReFi && currency1 != ReFi is logically equivalent to just currency1 != ReFi

Impact:

  • Pools where ReFi is currency0 will always revert with ReFiNotInPool() even when ReFi IS in the pool

  • The hook becomes non-functional for half of all valid pool configurations

Proof of Concept

When initializing a pool with ETH/ReFi where ReFi is currency1, the check passes. However, when initializing ReFi/USDC where ReFi is currency0, the check fails because it only examines currency1 (which is USDC), incorrectly reverting.

// Pool: ReFi (currency0) / USDC (currency1)
// Check: currency1 != ReFi && currency1 != ReFi
// Result: USDC != ReFi && USDC != ReFi = true → REVERTS incorrectly

Recommended Mitigation

Fix the condition to check both currencies:

function _beforeInitialize(address, PoolKey calldata key, uint160) internal view override returns (bytes4) {
- if (Currency.unwrap(key.currency1) != ReFi &&
- Currency.unwrap(key.currency1) != ReFi) {
+ if (Currency.unwrap(key.currency0) != ReFi &&
+ Currency.unwrap(key.currency1) != ReFi) {
revert ReFiNotInPool();
}
return BaseHook.beforeInitialize.selector;
}
Updates

Lead Judging Commences

chaossr Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Faulty pool check; only checks currency1 twice, omitting currency0.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!