★ Public initialize() without initializer modifier

Evidence summary #

Core V2 contracts use bespoke MapleProxied/NonTransparentProxy pattern without OZ Initializable — no public initialize() in the EVM sense; factory-controlled delegatecall init. MapleCCIPReceiver (UUPS, Jan 2026) exposes initialize(address,address) with likely OZ initializer modifier, but _disableInitializers() absence in constructor not confirmed from Etherscan ABI analysis. MapleLoanInitializer uses fallback-based init with no explicit re-initialization guard.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →