★ Reinitializable implementation (no _disableInitializers)
stHYPE (Valantis Labs)'s assessment for RD-F-143 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
stHYPE implementation (0xe71cAF5c) uses OZ Initializable with initialize(address gov_, address overseer, address wrapper). _disableInitializers() NOT confirmed present in constructor from source code inspection. OverseerV1 impl (0xaC43e7a1) and wstHYPE impl (0x104324863cfb) similarly use initialize() with no _disableInitializers() confirmed. Re-initialization of implementation contracts is possible if called directly. [CRITICAL — curator verification of source code constructor recommended]
Sources #
- URLHyperEVMScan — stHYPE implementation sourcehyperevmscan.io 0xe71cAF5c#code — OZ Initializable used; initialize(address gov_, address overseer, address wrapper) present; constructor minimal; _disableInitializers not confirmedretrieved 2026-05-17
- HyperEVMScan — wstHYPE implementation sourcehyperevmscan.io 0x104324863cfb#code — wstHYPE implementation; initialize() confirmed; _disableInitializers not confirmedretrieved 2026-05-17
- HyperEVMScan — OverseerV1 implementation sourcehyperevmscan.io 0xaC43e7a1#code — Overseer implementation uses initialize() via proxy pattern; _disableInitializers not confirmedretrieved 2026-05-17
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →