★ Public initialize() without initializer modifier
Usual (USD0 / bUSD0 / USUAL)'s assessment for RD-F-022 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
bUSD0 impl (0x9F2BD21): constructor calls _disableInitializers(); initializeV3 uses @initializer modifier — CLEAN. DaoCollateral impl (0x0eEc861): constructor calls _disableInitializers(); uses initializeV2 — CLEAN. USD0 impl (0xAe12F6F): uses initializeV2 with Initializable guard — CLEAN per Etherscan description. USUAL impl: likely CLEAN. Registry impl (0x81221180) does not visibly call _disableInitializers() — residual low-severity concern on a non-fund-holding contract. Critical financial contracts are properly guarded.
Sources #
- EtherscanDaoCollateral Implementation — EtherscanDaoCollateral impl — _disableInitializers() in constructor confirmedretrieved 2026-05-17
- bUSD0 Implementation — EtherscanbUSD0 impl — _disableInitializers() in constructor confirmedretrieved 2026-05-17
- Registry Implementation — EtherscanRegistry impl — missing _disableInitializers() notedretrieved 2026-05-17
Methodology #
Determine whether any implementation contract exposes `initialize(…)` without the OpenZeppelin `initializer` modifier or equivalent initialization lock.
See the full factor methodology and distribution across all protocols →