Constructor calls _disableInitializers()

Across Protocol's assessment for RD-F-023 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

SpokePool base constructor explicitly calls `_disableInitializers()` as its last statement (confirmed at commit 401e24c, with `@custom:oz-upgrades-unsafe-allow constructor` annotation). Ethereum_SpokePool's constructor passes through to the SpokePool constructor which calls `_disableInitializers()`. All chain-specific SpokePool variants inherit from SpokePool and therefore inherit this protection. Note: An earlier Etherscan-based WebFetch suggested the constructor does NOT call `_disableIniti...

Sources #

GitHub
https://github.com/across-protocol/contracts/blob/master/contracts/spoke-pools/Ethereum_SpokePool.solretrieved 2026-04-28
GitHub
https://github.com/across-protocol/contracts/blob/401e24ccca1b3af919dd521e58acd445297b65b6/contracts/SpokePool.solretrieved 2026-04-28

Methodology #

Determine whether implementation contract constructors call `_disableInitializers()` to prevent re-initialization of the implementation directly.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol across-protocol factor RD-F-023 score yellow collected_at 2026-04-30 21:19:18