★ Public initialize() without initializer modifier

Evidence summary #

CToken.sol initialize() protected by manual guard: require(accrualBlockNumber == 0 && borrowIndex == 0). GovernorBravoDelegate.sol initialize() protected by require(address(timelock) == address(0)) and require(msg.sender == admin). No OpenZeppelin initializer modifier (structurally unavailable on TVM). Manual guards are TVM-equivalent protection but not formally verified as equivalent. CErc20Delegator initializes via constructor delegatecall — no separate public initialize(). Assessment: yellow — manual guards exist and appear functionally effective for TVM, but not certified equivalent to OZ initializer pattern.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →