defirisk.co
rubric v1.7.0

Reinitializable implementation (no _disableInitializers)

Across Protocol's assessment for RD-F-143 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Reinitializable implementation | `_disableInitializers()` is present in SpokePool constructor (confirmed at GitHub commit f56146a01ca9c62e6206a2c23c55dbe01a25a912). OZ's V2 audit (2023) and subsequent audits reviewed the upgradeable pattern and found no reinitializer issue. HubPool is NOT a proxy (not upgradeable) so this factor applies primarily to SpokePool implementations. | GitHub SpokePool.sol at f56146a: `_disableInitializers()` in constructor; OZ UMA Across V2 audit 2023 (0 crit/high/m...

Sources #

  • Curator note
    Extracted from 02-governance-admin.md — RD-F-143; no URL citedretrieved 2026-04-28

Methodology #

Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol across-protocol factor RD-F-143 score gray collected_at 2026-04-30 21:19:18