★ Reinitializable implementation (no _disableInitializers)
Fluid's assessment for RD-F-143 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Infinite Proxy is not standard UUPS/Transparent. No initialize() called on module addition. AdminModule constructor lacks _disableInitializers() but module architecture doesn't expose reinitializer attack path. DummyImpl: no constructor/initialize. ReserveContract impl: _disableInitializers() confirmed. Non-standard pattern; standard reinitializer attack doesn't apply.
Sources #
- GitHubDummyImpl: no constructor, no initialize functionfluid-contracts-public/contracts/liquidity/dummyImpl.solretrieved 2026-04-29
- AdminModule constructor: no _disableInitializers() — but Infinite Proxy addImplementation() does not call initialize()fluid-contracts-public/contracts/liquidity/adminModule/main.sol constructorretrieved 2026-04-29
- ReserveContract impl: withdrawFunds() restricted to TREASURY_ADDRESS or BUYBACK_CONTRACT_ADDRESS0xFb3102759F2d57F547b9C519db49Ce1fFDE15dB2retrieved 2026-04-29
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol fluid factor RD-F-143 score gray collected_at 2026-04-29 10:35:01