★ Public initialize() without initializer modifier

Evidence summary #

The OpenZeppelin initializer modifier / unprotected initialize() pattern is an EVM Solidity vulnerability class (proxy re-initialization). Anchor Rust programs use discriminator-based account initialization (#[account(init, ...)]) which is enforced at the Solana runtime level — once an account is initialized with a discriminator, it cannot be re-initialized by any caller. No unprotected EVM-style initialize() surface exists. The program is fully open-source; all 6 audit engagements across 4 firms would have flagged this class of vulnerability if present. Zero exploit history in 4+ years corroborates the green finding.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →