★ Public initialize() without initializer modifier

Evidence summary #

VersionedInitializable pattern correctly applied across all Aave v3 implementation contracts. Revision counter prevents re-initialization at any version <= current revision — functionally equivalent to OZ initializer modifier. Certora FV covers initialization invariants. No unprotected initialize() found.

Detail #

T-10 noted this as the 'functional equivalent' finding and classified green. The VersionedInitializable.sol file is publicly inspectable. Methodology note surfaced in T-10 §2.3.6: 'RD-F-022 (VersionedInitializable vs _disableInitializers()) — Aave v3 pattern provides functional equivalent protection (revision tracking) but not canonical OZ; methodology should acknowledge functional equivalent middle state.'

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →