★ Public initialize() without initializer modifier

Evidence summary #

v2: ComposableStablePool uses struct-based constructor (not OZ Initializable proxy); Vault uses standard constructor (Solidity 0.7.1, Etherscan exact match confirmed). No public initialize() without initializer modifier found. v3: VaultExtension has an 'initialize' function for pool initialization but it is gated by 'onlyVaultDelegateCall' modifier — callable only via the Vault's delegatecall, not as a direct public call to the implementation address. This is not equivalent to the RD-F-022 pattern (which requires no protection). No one-tx exploit vector via unprotected initialize() found in either v2 or v3.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →