★ Public initialize() without initializer modifier

Evidence summary #

V3 VaultV3.vy exposes initialize() as an external function with a Vyper-native guard: assert self.asset == empty(address), 'initialized'. The __init__() constructor sets self.asset = self as a sentinel, preventing re-initialization. This is architecturally sound for Vyper but is not an OZ initializer modifier — Slither cannot detect it as protected. ChainSecurity audit confirmed no critical findings on initialization. Guard is confirmed from VaultV3.vy source inspection. Graded yellow because (a) Vyper-compiler-level bugs affecting initialization correctness cannot be ruled out without FV, and (b) the equivalence argument for the Vyper guard as an OZ initializer substitute relies on curator judgment.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →