★ Public initialize() without initializer modifier

Evidence summary #

Morpho Blue has no initialize() function — uses traditional constructor with newOwner parameter; MetaMorpho deployed via constructor with salt (not proxy initializer); no unprotected initialize() on any core contract.

Detail #

The ★ critical factor for unprotected initialize() does not apply to Morpho Blue because the protocol uses a plain constructor pattern throughout. Morpho.sol constructor: `constructor(address newOwner)` sets owner and DOMAIN_SEPARATOR. MetaMorpho factory deploys vaults via `new MetaMorpho{salt: salt}(initialOwner, MORPHO, initialTimelock, asset, name, symbol)` — also constructor-based. No proxy-initializer pattern exists in the deployed system that would expose a public initialize() vector.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →