★ Reinitializable implementation (no _disableInitializers)
M^0's assessment for RD-F-143 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core protocol contracts are immutable (non-proxy): N/A for them. Upgradeable proxies: (a) WrappedM impl 0x813B926B does NOT call _disableInitializers() in constructor (confirmed from source). (b) HubPortal impl 0xdFC64dbF uses initializeInitializationPhase() guard, not _disableInitializers(). (c) Portal Lite impl 0x901Cca92 (Portal.sol GitHub) shows no _disableInitializers() call. Multiple upgradeable implementations lack the canonical OZ re-initialization lock.
Sources #
- EtherscanHubPortal Proxy — EtherscanHubPortal impl: initializeInitializationPhase() not equivalent to _disableInitializers()retrieved 2026-05-16
- Portal.sol — m0-foundation/m-portal GitHubPortal.sol GitHub raw: no _disableInitializers() call in Portal Lite implementationretrieved 2026-05-16
- WrappedM Implementation — EtherscanWrappedM impl source: constructor accepts migrationAdmin_ and mToken_; no _disableInitializers() presentretrieved 2026-05-16
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →