★ Public initialize() without initializer modifier

Evidence summary #

No unprotected public initialize() on any live implementation contract found. FraxlendPair V1: has initialize() with AlreadyInitialized guard (custom pattern, not OZ modifier — but non-upgradeable standalone contract so re-init risk is limited to a separate attack vector). frxUSD OFT adapter: TransparentUpgradeableProxy with 'Initialized' events in ABI suggesting OZ initializer pattern used on implementation. sfrxETH: non-upgradeable ERC-4626 with constructor. FraxEtherRedemptionQueueV2: non-upgradeable with constructor. FraxGovernorAlpha/Omega: non-upgradeable. No one-tx exploit surface identified.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →