★ Public initialize() without initializer modifier

Evidence summary #

EVM initialize()+initializer modifier pattern is OpenZeppelin-specific. Anchor uses account discriminators and #[account(init)] constraints enforced at the Solana runtime level — an account can only be initialized once (runtime rejects re-initialization). This is a structural safety guarantee. No initialize() vulnerability class identified in any of the four published audits.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →