Constructor calls _disableInitializers()
Compound V3 (Comet)'s assessment for RD-F-023 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
OZ 2022 audit L04 'Logic contracts initialization allowed' was scoped to Configurator.sol (the upgradeable proxy implementation), not Comet.sol. Fixed in compound-finance/comet PR #425 / commit 79f59e5 (merged 2022-06-23): Configurator constructor sets version = type(uint256).max, so the existing 'if (version != 0) revert AlreadyInitialized()' guard blocks any direct initialize() call on the implementation. Comet.sol itself uses immutables in its constructor and a 'lastAccrualTime != 0' guard in initializeStorage(); not Initializable-proxied so _disableInitializers() does not apply. OZ marked the finding Fixed.
Sources #
- GitHubhttps://github.com/compound-finance/comet/pull/425retrieved 2026-05-06
- https://www.openzeppelin.com/news/compound-iii-audit/retrieved 2026-05-06
- https://www.openzeppelin.com/news/compound-iii-auditretrieved 2026-04-28
- https://github.com/compound-finance/comet/commit/79f59e5retrieved 2026-05-06
- https://github.com/compound-finance/comet/blob/main/contracts/Comet.solretrieved 2026-04-28
Methodology #
Determine whether implementation contract constructors call `_disableInitializers()` to prevent re-initialization of the implementation directly.
See the full factor methodology and distribution across all protocols →