★ Public initialize() without initializer modifier

Evidence summary #

All four core contracts use constructor-based initialization. USDe: constructor(address admin). EthenaMinting V2: constructor(IUSDe _usde, IWETH9 _weth, address[] _assets, ...). StakedUSDeV2: constructor(IERC20 _asset, address initialRewarder, address owner). ENA: constructor-based. No initialize() function on any implementation contract. One-tx exploit vector does not exist.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →