slither
slither copied to clipboard
Whitelist `_disableInitializers` to avoid reporting unprotected-upgradeable-contract
Describe the issue:
OpenZeppelin recently added support for _disableInitializers
which helps with disabling implementation initialization when used in the constructor of a contract. Slither should be able to pick that up and avoid reporting https://github.com/crytic/slither/wiki/Detector-Documentation#unprotected-upgradeable-contract.
There may be other cases where users have manually implemented initializer protection, not sure how easy would it be to support them and/or whether Slither already does that and it's only the _disableInitializers
support that is missing.
Code example to reproduce the issue:
pragma solidity >=0.8.4;
import '@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol';
contract A is UUPSUpgradeable {
constructor() {
_disableInitializers();
}
initialize() public virtual initializer { }
}
Version:
0.8.2
Relevant log output:
No response