★ Public initialize() without initializer modifier

Evidence summary #

Anchor programs use #[account(init)] constraints enforced at the runtime level — an account can only be initialized once (discriminator + non-zero lamports rejects re-init). No initialize() vulnerability class exists on Solana. No such finding in any of the five published audit reports.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →