# Missing `disableInitializers()` call in `StandardIDOPool::constructor()` Low/Info · Three Sigma · IDO launchpad · 7th August, 2024 Finding I-3 of the Blast IDO Pools security review. - Protocol: https://docs.blastup.io/blastup-docs - Report: /reports/blast-ido-pools - Source: https://cdn.sanity.io/files/qoqld077/production/d2a7ca81740e715b604122c12dafbce599e43f2f.pdf --- ### Description The implementation contract `StandardIDOPool` can be initialized by an attacker, although it can not do anything with it. ### Recommendation Call `_disableInitializers()` in the constructor of `StandardIDOPool`. --- Related findings: - [Missing disableInitializers() call in the constructor](https://0xsimao.com/findings/ostium-disable-initializers-call-constructor): Ostium - [Initializable constracts should call _disableInitializers() in the constructor instead of using the initializer modifier](https://0xsimao.com/findings/mitosis-initializable-constracts-initializers-initializer): Mitosis - [BRC20Factory constructor is missing a duplicate check](https://0xsimao.com/findings/orange-brc20-factory-constructor-duplicate): Orange Bridge - [BaseAssetManager missing 0 address checks in the constructor](https://0xsimao.com/findings/singularity-asset-address-checks-constructor): Singularity