★ Public initialize() without initializer modifier

Evidence summary #

Midas uses a MidasInitializable base contract that calls _disableInitializers() in the constructor, preventing re-initialization of the implementation. All initialize() functions use the OZ initializer modifier — confirmed: mBASIS ABI shows 'function initialize(address _accessControl) public initializer'; mTBILL shows initialize(address) and initializeV2() patterns consistent with OZ upgradeable. Sherlock 2024-08 M-4 (Corruptible Upgradability via missing storage gaps in non-pure parent contracts) is a different vulnerability class from missing initializer protection — M-4 was fixed. No missing initializer modifier finding in any of the 4 audit engagements.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →