initialization

# Initialization detection ## When this applies - OZ `Initializable` / `*Upgradeable` contracts - Custom upgradeable contracts with `initialize()` functions - Beacon proxies, UUPS, Transparent — all flavors - Factory-deployed clones (EIP-1167 minimal proxies) - Any deploy script that uses `delegatecall` for setup ## Detection patterns ### Implementation contract not init-locked (CRITICAL) ```solidity contract Vault is Initializable, OwnableUpgradeable { function initialize() external initializer { __Ownable_init(msg.sender); } // ← no constructor disabling initializers } ``` Anyone can call `initialize` on the *implementation* address directly. Fix: ```solidity /// @custom:oz-upgrades-unsafe-allow constructor constructor() { _disableInitializers(); } ``` ### Public initializer on deployed proxy (CRITICAL) Proxy deployment script forgets to call `initialize` atomically → attacker calls it first → owns the contract. Fix: deploy + initialize in same tx via factory or initializer-on-deploy proxy. ### Re-init via `reinitializer(N)` accessible to anyone (HIGH) ```solidity function reinitialize() external reinitializer(2) { // ← no auth __Pausable_init(); } ``` Add `onlyOwner` or `onlyProxyAdmin`. ### Parent init not called (HIGH) ```solidity function initialize() external initializer { // __Pausable_init() missing — pausable state defaults to wrong values } ``` Verify every parent's `__X_init()` is chained. ### Logic in constructor instead of i...