Constructor calls _disableInitializers()

Evidence summary #

Wormhole EVM implementation contracts do not call `_disableInitializers()` (OZ pattern introduced in OZ 4.6+). They use their own `initializer` modifier pattern instead, which achieves the same end goal by checking the implementation address against a mapping. The custom pattern was the root of the 2022 Immunefi finding (state could be cleared) but is now properly initialized. The absence of `_disableInitializers()` means the OZ canonical defense pattern is not in place; however the functiona...

Sources #

Methodology #

Determine whether implementation contract constructors call `_disableInitializers()` to prevent re-initialization of the implementation directly.

See the full factor methodology and distribution across all protocols →