Hello. Is reentancy attack possible if ReentrancyGuardUpgradeable is inherited in a contract but not intialized through including __ReentrancyGuard_init() into initialize()?
Hi, welcome to the community! 
Generally, it is recommend to do this in your initialize(). And which version do you use?
Thank you. I use @openzeppelin/contracts-upgradeable@5.1.0
But without initializing it, reentrancy protection still works, right?
If you use 0.5.x, I think you should call __ReentrancyGuard_init() explicitly, cause after 0.5.x, OpenZeppelin uses ERC-7201, that is namespaces storage layout, it will group storage variables together, so should call the function to initialize some value.
And you can check the value of this variable or make a test.
1 Like
Initializing ReentrancyGuardUpgradeable is preferred but not mandatory and reentrancy protection will still work.
Note: you must ensure that initializers are disabled if not explicitly calling them. This can be done by calling _disableInitializers.
2 Likes
Ohhhh, sorry for misleading you, I am wrong, as agreenberg said above, it is ok if you do not call __ReentrancyGuard_init(), the code is:
The key is before reentrancy, the value can not be
ENTERED(2 at here), so it does not matter if the value is 0(do not call __ReentrancyGuard_init()) or 1(call __ReentrancyGuard_init()).
Sorry again for misleading you.
Always write tests to verify your guesses.
@agreenberg @Skyge Thank you!
1 Like