Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-17·

Missing initializer guard in `_init()` function

Not reportedoptionsleverageblack-scholes
TL;DR

The internal function _init within ERC721WithURIBuilderUpgradeable.sol lacks the onlyInitializing modifier.

Severity
LOW
Method
MManual review
CAT.

The internal function _init within ERC721WithURIBuilderUpgradeable.sol lacks the onlyInitializing modifier. This function is called by the initializer function (init) of the upgradeable implementation contract PositionsManager.sol.

While the main PositionsManager.init function is protected by the initializer modifier, and the underlying __ERC721_init called by _init also has protection, the absence of the guard on _init itself poses a latent risk. If future upgrades to PositionsManager were to introduce new functions that mistakenly call _init again after initial deployment, there would be no direct protection at the _init level to prevent this call attempt.

Recommendation:

Add the onlyInitializing modifier to the ERC721WithURIBuilderUpgradeable._init function to explicitly enforce its initialization-only context and adhere to standard upgradeable contract patterns.

solidity
function _init(string memory name_, string memory symbol_) internal onlyInitializing {
__ERC721_init(name_, symbol_);
}
02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-17