★ Public initialize() without initializer modifier
Lido's assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Lido.sol (0.4.24): initialize() uses Aragon onlyInit modifier (equivalent to OZ initializer). VaultHub (0.8.25): initialize() has OZ initializer modifier, constructor calls _disableInitializers(). StakingVault (0.8.25): initialize() has OZ initializer modifier, constructor calls _disableInitializers(). All implementations properly guarded against unprotected re-initialization.
Sources #
- URLLido.solhttps://github.com/lidofinance/core/blob/master/contracts/0.4.24/Lido.solretrieved 2026-04-28
- VaultHub.solhttps://github.com/lidofinance/core/blob/master/contracts/0.8.25/vaults/VaultHub.solretrieved 2026-04-28
- StakingVault.solhttps://github.com/lidofinance/core/blob/master/contracts/0.8.25/vaults/StakingVault.solretrieved 2026-04-28
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol lido factor RD-F-022 score green collected_at 2026-04-28 13:58:42