Skip to content
Request an audit

‹ All findings

Missing disableInitializers() call in the constructor

MediumVertex·by the Three Sigma team·Hybrid orderbook DEX·3rd April 20243S-Vertex-M01

Description

When using Initializable.sol, it's a good practice calling disableInitializers() in the constructor, such that the implementation itself can't be initialized.

The call is missing in the Clearinghouse.sol, Endpoint.sol, OffchainExchange.sol, PerpEngine.sol, SpotEngine.sol, ClearinghouseLiq.sol and Verifier.sol (commented out).

ClearingHouse may be selfdestructed via the delegateCall().

Recommendation

Use:

solidity
constructor() {
    _disableInitializers();
}

Status

Acknowledged