Description:
_beforeInitialize has an obvious copy-paste bug:
It checks currency1 twice, never checking currency0. The condition simplifies to
if (currency1 != ReFi) revert ReFiNotInPool().
Impact:
Every valid pool using this hook is forced to have ReFi as currency1. It breaks a core protocol invariant and potentially exposing the protocol to misconfiguration and non-standard fee logic.
Proof of Concept:
function test_BeforeInitialize_ForcesReFiToBeCurrency1() public {
// Expect revert with ReFiNotInPool when trying to initialize a pool
// where currency0 == ReFi and currency1 != ReFi.
vm.expectRevert(ReFiSwapRebateHook.ReFiNotInPool.selector);
(key, ) = initPool(
reFiCurrency, // currency0 = ReFi
tokenCurrency, // currency1 = not ReFi
rebateHook,
LPFeeLibrary.DYNAMIC_FEE_FLAG,
SQRT_PRICE_1_1_s
);
}
Mitigation:
Replace the second key.currency1 with key.currency0:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.