Constructor calls _disableInitializers()
Convex Finance's assessment for RD-F-023 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
ExtraRewardStashV3 constructor only sets tokenWrapperImplementation and provides no initialization lock. All mainnet contracts use Solidity 0.6.12 with OZ 3.4.0, which predates the _disableInitializers() pattern (OZ 4.x, 0.8.x). For non-proxy contracts (Booster, VoterProxy), this factor is N/A by construction (they use constructors directly). The gap is specific to the ExtraRewardStashV3 implementation used in the clone pattern.
Sources #
- GitHubplatform package.json (OZ 3.4.0, predates _disableInitializers pattern)package.json OZ 3.4.0 - predates disableInitializersretrieved 2026-05-16
- Convex ExtraRewardStashV3.sol constructor (no _disableInitializers equivalent)ExtraRewardStashV3 constructor - no disableInitializersretrieved 2026-05-16
Methodology #
Determine whether implementation contract constructors call `_disableInitializers()` to prevent re-initialization of the implementation directly.
See the full factor methodology and distribution across all protocols →