★ Reinitializable implementation (no _disableInitializers)

Ondo Finance's assessment for RD-F-143 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Mixed: USDY.sol and rOUSG.sol call _disableInitializers() (green). CashKYCSenderReceiver (0x1CEB44b6e515abf009e0ccb6ddafd723886cf3Ff, current OUSG proxy impl) analyzed via Etherscan — does not confirm _disableInitializers() call in constructor. Assessed yellow pending code-security-analyst static analysis confirmation.

Sources #

Etherscan
https://etherscan.io/address/0x1CEB44b6e515abf009e0ccb6ddafd723886cf3Ffretrieved 2026-04-28
GitHub
https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/rOUSG.solretrieved 2026-04-28
GitHub
https://github.com/ondoprotocol/usdy/blob/main/contracts/usdy/USDY.solretrieved 2026-04-28

Methodology #

Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol ondo-finance factor RD-F-143 score yellow collected_at 2026-05-14 12:01:55