Constructor calls _disableInitializers()
Lista DAO's assessment for RD-F-023 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
PSM.sol and DynamicDutyCalculator.sol correctly call _disableInitializers() in their constructors. However, older core contracts — Interaction.sol, vat.sol, jug.sol, hay.sol, flash.sol — do NOT have a constructor calling _disableInitializers(). These are the highest-TVL contracts (CDP vault state). Implementation contracts are directly re-initializable if not protected by access control on the initialize function. New 2024-era contracts have correct protection; 2022-era CDP core does not.
Sources #
- GitHubInteraction.sol — missing _disableInitializers()Interaction.sol — no constructor, no _disableInitializers(); vat.sol — no _disableInitializers() in constructorretrieved 2026-05-12
- PSM.sol — _disableInitializers() in constructorPSM.sol — constructor calls _disableInitializers(); DynamicDutyCalculator.sol — constructor calls _disableInitializers()retrieved 2026-05-12
Methodology #
Determine whether implementation contract constructors call `_disableInitializers()` to prevent re-initialization of the implementation directly.
See the full factor methodology and distribution across all protocols →