Root + Impact

Description

• Normally, _beforeInitialize is supposed to validate that the pool being initialized contains the designated ReFi token in either currency0 or currency1. This ensures that the hook only attaches to relevant pools.

• The specific issue is that _beforeInitialize contains a logic bug where it checks currency1 twice instead of checking both currency0 and currency1.

Risk

Likelihood:

• The hook will attach to any pool where currency0 is ReFi but currency1 is not, because currency0 is never checked.

• The hook could also attach to pools that contain neither token if currency1 happens to be something else, bypassing the intended validation.

Impact:

• The hook will incorrectly execute fee logic on pools that do not actually contain the ReFi token.

• Swap operations in these misconfigured pools may apply buy/sell fees to irrelevant token pairs, leading to unexpected token deductions or fee misapplications.

Proof of Concept

The following test demonstrates that the hook allows initialization of a pool that does not include the ReFi token:

Explanation:
Because _beforeInitialize only checks currency1 twice, the check incorrectly passes if currency0 is not ReFi, allowing the hook to attach to the pool. Any subsequent swaps in this pool will apply ReFi fee logic incorrectly.

Recommended Mitigation

You said: