★ Reinitializable implementation (no _disableInitializers)
Balancer (v2 + v3)'s assessment for RD-F-143 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Neither v2 nor v3 uses a UUPS/transparent proxy pattern that would expose initialize() to re-initialization. v2 Vault is immutable. v3 Vault uses internal delegatecall to VaultExtension/VaultAdmin (immutable fixed addresses). No initialize() re-initialization attack surface exists. Certora formal verification 2024-09 covered Vault architecture. Architecture confirmed via profile and docs.
Sources #
- DocsBalancer v3 Vault Configurationv3 Vault architecture — no proxy/initializer patternretrieved 2026-05-05
- Certora v3 Vault Formal Verification 2024-09Certora September 2024 formal verification — Vault architecture securityretrieved 2026-05-05
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →