Root + Impact

Description

• The _afterInitialize function is intended to set up critical launch parameters (such as startBlock and phase durations) exactly once for the specific legitimate pool associated with the token launch. Once initialized, these time-sensitive state variables should remain immutable to ensure the integrity of the anti-bot phases.

• Lacks validation to verify the identity of the PoolKey or check if the hook has already been initialized. Since Uniswap V4 allows any user to attach an existing hook to a new malicious pool, an attacker can trigger _afterInitialize repeatedly. This action overwrites global state variables.

Risk

Likelihood:

The V4 allows any one to create pool, automatically executing the initialization logic of hook without restriction

Impact:

Attacker can repeatedly resetting the `lauchStartBlock`, so that this initial phase never changes

Proof of Concept

_afterInitialize function fails to prevent re-initialization.
Attacker can create a new pool with a different tickSpacing to trigger
_afterInitialize again.
Can overwrites launchStartBlock,
resetting the anti-bot phases.

Recommended Mitigation

Let's write a decorator that uses an existing variable (launchStartBlock) as the sole check:
if it has already been initialized once, launchStartBlock will be greater than 0,
which ensures the initialization runs only once.