# Is \_disableInitializers necessary?

**URL:** <https://forum.openzeppelin.com/t/is-disableinitializers-necessary/31070>\
**Category:** Upgrades\
**Created:** [August 10, 2022, 10:05am UTC](https://forum.openzeppelin.com/t/is-disableinitializers-necessary/31070 "2022-08-10T10:05:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![itsgeorgep](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/itsgeorgep/32/15846_2.png) [@itsgeorgep](https://forum.openzeppelin.com/u/itsgeorgep)\
**Post date:** [August 10, 2022, 10:05am UTC](https://forum.openzeppelin.com/t/is-disableinitializers-necessary/31070/1 "2022-08-10T10:05:06Z")

</div>

The docs say to use the `_disableInitializers` function, otherwise our contract might be vulnerable to attacks. Is this true?

If so, how would one perform this attack? How can this function prevent the attack from happening? Is any contract without this vulnerable?

---

<div class="post-metadata">

**Author:** ![ericglau](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/ericglau/32/15149_2.png) [@ericglau](https://forum.openzeppelin.com/u/ericglau)\
**Post date:** [August 10, 2022, 2:09pm UTC](https://forum.openzeppelin.com/t/is-disableinitializers-necessary/31070/2 "2022-08-10T14:09:16Z")

</div>

Having a constructor that uses `_disableInitializers()` is recommended as a best practice to prevent initialization of the **implementation** contract itself.

There was a [previous UUPS vulnerability](https://forum.openzeppelin.com/t/uupsupgradeable-vulnerability-post-mortem/15680) where if an implementation contract was initialized by an attacker, the attacker could give themselves upgrade authority and delegate a call to a malicious contract that causes the implementation contract to self destruct. That vulnerability was resolved by restricting the upgrade functions to `onlyProxy`, but disabling initializers is still recommended as an extra layer of protection against these types of attacks.