Submitted by said
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/hook/MoneyMarketHook.sol#L168-L196 
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/hook/MoneyMarketHook.sol#L76-L80
When param.returnNative is set to true while calling MoneyMarketHook.execute, users expect the returned token from the withdraw operation to be in native form and sent to the caller. However, in the current implementation, this is not considered and could disrupt user expectations.
The withdraw functionality inside MoneyMarketHook will process the WithdrawParams provided by users and construct the operations using _handleWithdraw, which consist of calling decollateralize and burnTo in InitCore, providing the parameters accordingly.
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/hook/MoneyMarketHook.sol#L168-L196
As it can be observed, _handleWithdraw doesnt check param.returnNative and not adjust the uTokenReceiver token receiver to address(this) when param.returnNative is set to true.
Now, when execute finish perform the multicall and check that _params.returnNative is set to true, it will not work properly as the token is not send to the Hook.
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/hook/MoneyMarketHook.sol#L76-L80
This could disrupt user expectations. Consider a third-party contract integrated with this hook that can only operate using native balance, doesnt expect, and cannot handle tokens/ERC20. This can cause issues for the integrator.
When constructing withdraw operation, check if _params.returnNative is set to true, and change uTokenReceiver to address(this.
fez-init (INIT) confirmed
