★ Reinitializable implementation (no _disableInitializers)
Convex Finance's assessment for RD-F-143 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
All core contracts (Booster, VoterProxy, CVX, CvxLockerV2, BoosterOwner) are non-proxy, non-upgradeable immutable contracts using constructors. No initialize() function; no _disableInitializers() requirement; no reinitializer risk. The proxy takeover attack vector (F143) does not apply to immutable contract architecture.
Sources #
- GitHubConvex Booster.sol -- GitHub sourceBooster.sol: constructor-based deployment, no initializer, no proxyretrieved 2026-05-16
- CvxLockerV2 -- EtherscanCvxLockerV2 0x72a193... -- verified source; no proxy, no initializer; uses Ownable and ReentrancyGuard with constructorretrieved 2026-05-16
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol convex-finance factor RD-F-143 score green collected_at 2026-05-16 02:41:28