defirisk.co
rubric v1.7.0

Public initialize() without initializer modifier

crvUSD (Curve Stablecoin)'s assessment for RD-F-022 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

crvUSD is a Vyper codebase with no OZ proxy pattern. Vyper contracts use @deploy __init__() constructors, not proxy initializers. There is no OpenZeppelin initializer modifier concept in Vyper, and no initialize() function exists in any deployed crvUSD contract. All contracts are immutable non-proxy deployments. The ★ critical factor RD-F-022 is structurally not_applicable for pure Vyper non-proxy protocols.

Sources #

  • GitHub
    controller.vy — GitHubcontroller.vy master — @deploy __init__() constructor, no initialize()retrieved 2026-05-16
  • GitHub
    AMM.vy — GitHubAMM.vy master — @deploy __init__() constructor, no initialize()retrieved 2026-05-16

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol crvusd factor RD-F-022 score not_applicable collected_at 2026-05-16 19:09:40