★ Public initialize() without initializer modifier
Lista DAO's assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
All reviewed implementation contracts expose initialize() with the OZ initializer modifier: Interaction.sol (public initializer), vat.sol (public initializer), jug.sol (external initializer), hay.sol (external initializer), flash.sol (external initializer), LisUSD.sol (initializer ~line 106), PSM.sol (initializer), DynamicDutyCalculator.sol (external initializer). No unprotected initialize() found in any reviewed contract.
Sources #
- GitHubvat.sol initialize() with initializer modifiervat.sol initialize() public initializer confirmed; jug.sol external initializer confirmed; hay.sol external initializer confirmedretrieved 2026-05-12
- Interaction.sol initialize() with initializer modifierInteraction.sol initialize() public initializer at lines ~178-191retrieved 2026-05-12
- PSM.sol initialize() with initializer modifierPSM.sol and DynamicDutyCalculator.sol — both have initializer modifier AND _disableInitializers() in constructorretrieved 2026-05-12
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →