★ Public initialize() without initializer modifier

Evidence summary #

Centrifuge V3/V3.1 uses no upgradeable proxy pattern. All contracts use standard constructors (e.g., constructor(uint256 _delay, address deployer) Auth(deployer)). No initialize() function found in Root.sol, Gateway.sol, InvestmentManager, PoolManager, or WormholeAdapter. The MakerDAO-inspired ward pattern is constructor-initialized.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →