★ Public initialize() without initializer modifier
BENQI's assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
QiToken.sol initialize() is public but protected by the Compound V2 initialization lock: require(accrualBlockTimestamp == 0 && borrowIndex == 0, 'market may only be initialized once') — equivalent to the OZ initializer modifier effect. StakedAvax.sol uses the explicit OZ initializer modifier: 'function initialize(uint _cooldownPeriod, uint _redeemPeriod) initializer public'. Dedaub Ignite L2 (initializer-related low severity) was marked resolved. No unguarded public initialize identified across the inspected contracts. Green.
Sources #
- AuditDedaub Ignite Audit — L2 initializerDedaub L2 (initializer low severity, resolved) — Ignite contractsretrieved 2026-05-16
- StakedAvax.sol — OZ initializer modifierStakedAvax.sol initialize() — explicit OZ initializer modifier confirmedretrieved 2026-05-16
- QiToken.sol — initialize() guard patternQiToken.sol initialize() — Compound V2 init-lock guard (accrualBlockTimestamp == 0 && borrowIndex == 0)retrieved 2026-05-16
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →