★ Public initialize() without initializer modifier

Evidence summary #

V2 PancakePair.initialize(address,address) is guarded by require(msg.sender == factory) — factory-only guard prevents unauthorized calls for this non-proxy architecture. V3 Pool has no initialize function (constructor-deployed). Infinity Vault has no proxy initialize pattern. MasterChef V2 uses a custom init() gated by onlyOwner. No exploitable unprotected initialize found on any live implementation.

Sources #

Methodology #

Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.

See the full factor methodology and distribution across all protocols →