★ Public initialize() without initializer modifier
mETH Protocol's assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
All inspected implementation contracts use the initializer modifier on initialize(): Staking.sol (confirmed), Oracle.sol (confirmed), ReturnsAggregator.sol (confirmed), UnstakeRequestsManager.sol (confirmed), Pauser.sol (confirmed), OracleQuorumManager.sol (confirmed), L1cmETHAdapter (confirmed). No unprotected initialize() found across the core staking surface. LiquidityBuffer impl shows OZ initializer-flag protection. No public initialize() without protection was identified.
Sources #
- EtherscanL1cmETHAdapter implementation — initialize() with initializer modifierL1cmETHAdapter (0xaE96dF024b9cb69a39a219d7176df6e7e39fac44): initialize() uses initializer modifierretrieved 2026-05-16
- Staking.sol — initialize() with initializer modifierStaking.sol: 'function initialize(Init memory init) external initializer' — initializer modifier confirmedretrieved 2026-05-16
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →