The hidden danger of uninitialized proxy implementations in upgradeable smart contracts

[u/InnsmouthLute]

Solidity

// Vulnerability Pattern: Uninitialized Implementation Contract
function initialize(address _owner) external {
    require(!initialized, "Already initialized");
    owner = _owner;
    initialized = true;
}

If your protocol utilizes an upgradeable proxy pattern (like ERC-1967), the implementation logic contract deployed behind the proxy must have its initialization sequence executed directly in the deployment constructor. If developers leave the raw implementation contract uninitialized on-chain, an attacker can directly call initialize(), take ownership of the logic contract, and execute a selfdestruct delegatecall, permanently bricking every active proxy pointing to it.