In this track: Smart contract security foundations
advanced · 4 MIN READ
Uninitialized contracts and initializers
An exposed setup function can become an unintended ownership path.
LET’S PICTURE IT
A newly installed office has an unlocked registration desk until its first manager is recorded.
SEE IT FOR YOURSELF
A valid counter call, step by stepStep 1 / 4
This example begins with count zero and a request to call increment(). No real contract is deployed.
This example begins with count zero and a request to call increment(). No real contract is deployed.Execution follows the code’s input and permission rules. A website button is not the access-control mechanism.The function reads zero, calculates zero plus one, and writes one to persistent storage.The accepted state contains count one. Later reads can inspect it. Events are emitted only if the code implements them.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Separate constructors and proxy setup
A constructor initializes its own creation context. A proxy using delegate execution generally needs its intended state initialized in the proxy context.
Control who may initialize
An initializer can assign authority or configure critical addresses. Leaving it freely callable before intended setup can let another actor choose those values.
Prevent unintended repetition
One-time setup needs an enforced state rule. Later reinitialization versions require their own authorization and sequencing analysis.
Test deployment as one workflow
Review the factory or deployment procedure, not just the final initialized state. Include attempts before setup, after setup and through implementation-related paths.
Reason about the scenario
deploy proxy
initialize intended proxy state under controlled conditions
reject unauthorized or repeated setup
Pseudocode or a simplified scenario for local reasoning. This is not a production contract or a completed security review.
QUICK CHECK · NO PRESSURE
Does an implementation constructor automatically initialize proxy storage?
Proxy state exists in a different storage context.