★ Public initialize() without initializer modifier

Evidence summary #

`Implementation.sol`: `function initialize() initializer public virtual` — the custom `initializer` modifier checks `!isInitialized(ERC1967Upgrade._getImplementation())` before permitting initialization, storing a flag by implementation address. This effectively prevents re-initialization of any given implementation. `BridgeImplementation.sol` uses the same pattern. The 2022 Immunefi issue ($10M payout) was NOT a missing modifier — it was that the implementation's initialized flag had been cl...

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →