Root + Impact

Normal Expected Behaviour

During pool initialization, the hook should verify that either currency0 or currency1 in the PoolKey corresponds to the designated ReFi token.
If the ReFi token is not part of the pool, initialization must revert.

Actual Issue

The validation incorrectly checks the same value (currency1) twice, due to a copy-paste mistake:

This results in:

• currency0 is never checked

• Pools where ReFi is in currency0 mistakenly revert

• Pools where neither token is ReFi may incorrectly pass if another bug masks it

• Protocol assumptions break, and hook safety is compromised

Impact Summary

• Hook may fail to enforce ReFi-only pools

• Hook may block valid pools

• Hook may allow invalid pools

• Breaks core economic model assumptions (dynamic fees applied only to ReFi pools)

Risk

Likelihood: High

• Reason 1: Occurs every time the hook is used during initialization

• Reason 2: Affects all pools where ReFi is token0

• Reason 3: Hook logic fully depends on correct ReFi presence

Impact:

• Protocol Misconfiguration
  Incorrect pool creation prevents fee logic from triggering properly.

Security Model Breaks
Dynamic fee assumptions fail, leading to incorrect buy/sell fee application.

• User Funds at Risk (Indirect)
  Wrong pools may experience unexpected fee behavior.

Proof of Concept

Expected: Should pass
Actual: Reverts due to bug

Recommended Mitigation

Fix : Validate both tokens

Replace duplicated condition with correct logic: