★ Public initialize() without initializer modifier
Chainlink CCIP's assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Inspected Router, OffRamp.sol, OnRamp.sol, ARM (0x8B63b3DE), ARMProxy (0x411dE17f), ManyChainMultiSig.sol, RBACTimelock.sol — none have an initialize() function. All use constructors for initialization. No proxy implementation with unguarded initialize() found in core CCIP contracts.
Sources #
- GitHubOffRamp.sol — constructor pattern (no initialize function)OffRamp.sol — standard constructor, no initialize()retrieved 2026-05-16
- CCIP Router — Etherscan: immutable, no initialize()Router (0x80226fc0) — standard contract, not upgradeable, no initialize()retrieved 2026-05-16
- ARM (RMN) implementation — Etherscan source: no initialize()ARM implementation (0x8B63b3DE) — no initialize() functionretrieved 2026-05-16
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol chainlink-ccip factor RD-F-022 score green collected_at 2026-05-16 01:55:09