★ Reinitializable implementation (no _disableInitializers)
Concrete's assessment for RD-F-143 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
ConcreteFactory implementation calls _disableInitializers() in constructor (confirmed from GitHub raw source). VaultProxy.sol sets _admin=msg.sender immutably at construction (no re-init path). ConcreteStandardVaultImpl uses _initialize() called only through factory's CREATE2 deployment flow — single-initialization enforced by proxy pattern. Halborn V2 audit (0 critical/high findings) would have flagged missing disableInitializers.
Sources #
- GitHubConcreteFactory.sol — _disableInitializers() in constructor confirmedConcreteFactory.sol constructor: `constructor() { _disableInitializers(); }` — explicitly confirmedretrieved 2026-05-17
- VaultProxy.sol — immutable admin (no reinit path)VaultProxy.sol constructor: `_admin = msg.sender` (immutable); no initialize() path on proxy itselfretrieved 2026-05-17
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →