# Missing _disableInitializers() call in the constructor Low/Info · Three Sigma · DeFi infrastructure · 15th March 2024 Finding 3S-Clip-L02 of the Clip Finance Strategy Upgrade security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-strategy-upgrade - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-03-15-clip-finance-ii.pdf --- ### Description PCLBaseSwapInside() is missing a _disableInitializers() call in the constructor, allowing the implementation contract to be initialized. This is not a security concern at the moment but could be in a future version of the implementation. ### Recommendation Add _disableInitializers() to the constructor. ### Status Addressed in [#0c8de23](https://github.com/ClipFinance/StrategyRouter-private/commit/0c8de23862d9fed65f3c1a3fc4eac9a0356ef76e#diff-beff087703331ce52098fdaead1b111bd9098796536448854363c93cf8b08707R81). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Missing `disableInitializers()` call in `StandardIDOPool::constructor()`](https://0xsimao.com/findings/blast-ido-pools-disable-initializers-standard-constructor): Blast IDO Pools - [Missing disableInitializers() call in the constructor](https://0xsimao.com/findings/ostium-disable-initializers-call-constructor): Ostium - [Missing disableInitializers() call in the constructor](https://0xsimao.com/findings/vertex-disable-initializers-call-constructor): Vertex - [Initializable constracts should call _disableInitializers() in the constructor instead of using the initializer modifier](https://0xsimao.com/findings/mitosis-initializable-constracts-initializers-initializer): Mitosis