★ Public initialize() without initializer modifier
Across Protocol's assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Ethereum_SpokePool's `initialize()` is declared `public initializer` (OZ standard modifier) — confirmed from the GitHub master branch (`contracts/spoke-pools/Ethereum_SpokePool.sol`, function signature: `function initialize(uint32 _initialDepositId, address _withdrawalRecipient) public initializer`). SpokePool base constructor calls `_disableInitializers()` (confirmed commit 401e24c), preventing direct impl initialization. HubPool has no initialize function (uses constructor).
Sources #
- GitHub
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →