★ Reinitializable implementation (no _disableInitializers)
Yearn Finance's assessment for RD-F-143 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Vyper-native re-initialization guard — not EVM/OZ pattern. VaultV3.vy __init__() sets self.asset = self (makes it non-empty on the implementation). initialize() asserts self.asset == empty(address) — fails on implementation since self.asset = self was set. All vault instances (EIP-1167 proxies) initialize exactly once via VaultFactory. Implementation cannot be re-initialized. V2 vaults: fully immutable Vyper, no initialize() at all. F143 'no _disableInitializers' framing does not apply to Vyper; the Vyper guard achieves equivalent protection.
Sources #
- GitHubVaultV3.vy — yearn-vaults-v3 GitHubVaultV3.vy __init__: 'self.asset = self'; initialize(): 'assert self.asset == empty(address), initialized' — Vyper re-init guardretrieved 2026-05-16
Methodology #
Determine whether the implementation contract does not call `_disableInitializers()` in its constructor, leaving re-initialization possible.
See the full factor methodology and distribution across all protocols →