RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Duplicate Condition Check Preventing Proper ReFi Validation

seenu1947

Root + Impact

Description

Normal Behavior:
The _beforeInitialize hook in RebateFiHook.sol is intended to validate that at least one of the pool currencies is the ReFi token. If neither currency is ReFi, the pool initialization should revert.

Observed Issue:
The current implementation checks key.currency1 twice, neglecting key.currency0. As a result, a pool could be initialized where neither currency is ReFi, bypassing intended protocol safeguards.

function _beforeInitialize(address, PoolKey calldata key, uint160) internal view override returns (bytes4) {
if (Currency.unwrap(key.currency1) != ReFi &&
Currency.unwrap(key.currency1) != ReFi) { // Checks currency1 twice
revert ReFiNotInPool();
}
return BaseHook.beforeInitialize.selector;
}
​

Risk

Likelihood:

Any pool creation with two non-ReFi tokens will trigger this scenario.

High usage pools or automated scripts could unknowingly initialize invalid pools.

Impact:

Pools may be initialized without the ReFi token, violating core protocol rules.

Could lead to downstream logic failures, incorrect fee calculations, or lost protocol revenue.

Proof of Concept

// currency0 is NOT ReFi, currency1 IS ReFi
PoolKey memory key = PoolKey({
currency0: USDC,
currency1: ReFi,
fee: 500
});
​
// Buggy code only checks currency1 twice, so:
// Currency.unwrap(key.currency1) != ReFi && Currency.unwrap(key.currency1) != ReFi
// ReFi != ReFi → false && false → false → does NOT revert
_beforeInitialize(address(this), key, 0); // Should check currency0 but passes due to bug
​

Recommended Mitigation

- if (Currency.unwrap(key.currency1) != ReFi &&
- Currency.unwrap(key.currency1) != ReFi) {
- revert ReFiNotInPool();
+ if (Currency.unwrap(key.currency0) != ReFi &&
+ Currency.unwrap(key.currency1) != ReFi) {
+ revert ReFiNotInPool();
​
Updates

Lead Judging Commences

chaossr Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Faulty pool check; only checks currency1 twice, omitting currency0.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!