★ Reinitializable implementation (no _disableInitializers)
Hyperlane's assessment for RD-F-143 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Mailbox.sol constructor does NOT call _disableInitializers(). Constructor only sets immutable localDomain. The initialize() function uses the initializer modifier but only on the proxy side — the bare implementation contract is not locked. HypERC20Collateral.sol constructor also does not call _disableInitializers(). Any caller can initialize the unprotected implementation contract directly, enabling a proxy takeover scenario.
Sources #
- GitHubHypERC20Collateral.sol constructorHypERC20Collateral.sol constructor: no _disableInitializers() callretrieved 2026-05-17
- Mailbox.sol constructor sourceMailbox.sol constructor: 'constructor(uint32 _localDomain) { localDomain = _localDomain; }' — no _disableInitializers() callretrieved 2026-05-17
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →