★ Public initialize() without initializer modifier
Cap (cUSD / stcUSD)'s assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
All inspected UUPS implementation contracts: (1) call _disableInitializers() in constructor, AND (2) use the 'initializer' modifier on initialize(). Confirmed for: CapToken.sol, StakedCap.sol, Lender.sol, AccessControl.sol, EigenAgentManager.sol, SymbioticNetworkMiddleware.sol, OFTLockboxUpgradeable.sol, L2TokenUpgradeable.sol, CapInterestHarvester.sol. No unprotected initialize() found across 9 inspected implementation contracts.
Sources #
- GitHubStakedCap.sol — Initialize Protectioncontracts/token/StakedCap.sol — constructor: _disableInitializers(); initialize: initializer modifierretrieved 2026-05-17
- CapToken.sol — Initialize Protectioncontracts/token/CapToken.sol — constructor: _disableInitializers(); initialize: initializer modifierretrieved 2026-05-17
- EigenAgentManager.sol — Initialize Protectioncontracts/delegation/providers/eigenlayer/EigenAgentManager.sol — both patterns confirmedretrieved 2026-05-17
- Lender.sol — Initialize Protectioncontracts/lendingPool/Lender.sol — constructor: _disableInitializers(); initialize: external initializerretrieved 2026-05-17
- SymbioticNetworkMiddleware.sol — Initialize Protectioncontracts/delegation/providers/symbiotic/SymbioticNetworkMiddleware.sol — both patterns confirmedretrieved 2026-05-17
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →