Restricting initializer and calling _disableInitializers in implementation contract deployed behind deployProxy

Support Upgrades
1

When you have an implementation contract deployed behind deployProxy of openzeppelin, is allowed to:

  1. Leave the implementation contract initialize function unrestricted?
  2. Not call _disableInitializers() in the implementation contract constructor?
2
  1. Yes, but to prevent frontrunning, the initialize function should be called in the same transaction as the proxy deployment. This occurs by default when you use deployProxy from the Hardhat Upgrades plugin.
  2. _disableInitializers() is recommended. See What does `_disableInitializers();` function mean? for reasoning.