# Should ReentrancyGuard be always initialized in an upgradable contract? Will the protection work when not initialized?

**URL:** <https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238>\
**Category:** Contracts\
**Created:** [February 12, 2025, 9:54am UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238 "2025-02-12T09:54:40Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sol\_Ch](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/sol_ch/32/22084_2.png) [@Sol\_Ch](https://forum.openzeppelin.com/u/Sol_Ch)\
**Post date:** [February 12, 2025, 9:54am UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238/1 "2025-02-12T09:54:40Z")

</div>

Hello. Is reentancy attack possible if `ReentrancyGuardUpgradeable` is inherited in a contract but not intialized through including `__ReentrancyGuard_init()` into `initialize()`?

---

<div class="post-metadata">

**Author:** ![Skyge](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/skyge/32/343_2.png) [@Skyge](https://forum.openzeppelin.com/u/Skyge)\
**Post date:** [February 13, 2025, 12:19am UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238/2 "2025-02-13T00:19:55Z")

</div>

Hi, welcome to the community! 👋

Generally, it is recommend to do this in your `initialize()`. And which version do you use?

---

<div class="post-metadata">

**Author:** ![Sol\_Ch](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/sol_ch/32/22084_2.png) [@Sol\_Ch](https://forum.openzeppelin.com/u/Sol_Ch)\
**Post date:** [February 13, 2025, 10:09am UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238/3 "2025-02-13T10:09:09Z")

</div>

Thank you. I use @openzeppelin/contracts-upgradeable@5.1.0  
But without initializing it, reentrancy protection still works, right?

---

<div class="post-metadata">

**Author:** ![Skyge](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/skyge/32/343_2.png) [@Skyge](https://forum.openzeppelin.com/u/Skyge)\
**Post date:** [February 13, 2025, 2:30pm UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238/4 "2025-02-13T14:30:23Z")

</div>

~~If you use 0.5.x, I think you should call `__ReentrancyGuard_init()` explicitly, cause after 0.5.x, OpenZeppelin uses ERC-7201, that is namespaces storage layout, it will group _storage_ variables together, so should call the function to initialize some value.  
And you can check the value of this variable or make a test.~~

---

<div class="post-metadata">

**Author:** ![agreenberg](https://avatars.discourse-cdn.com/v4/letter/a/c4cdca/32.png) [@agreenberg](https://forum.openzeppelin.com/u/agreenberg)\
**Post date:** [February 13, 2025, 5:04pm UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238/5 "2025-02-13T17:04:57Z")

</div>

Initializing `ReentrancyGuardUpgradeable` is preferred but not mandatory and reentrancy protection will still work.

Note: you must ensure that initializers are disabled if not explicitly calling them. This can be done by calling `_disableInitializers`.

---

<div class="post-metadata">

**Author:** ![Skyge](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/skyge/32/343_2.png) [@Skyge](https://forum.openzeppelin.com/u/Skyge)\
**Post date:** [February 14, 2025, 12:46am UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238/6 "2025-02-14T00:46:11Z")

</div>

Ohhhh, sorry for misleading you, I am wrong, as `agreenberg` said above, it is ok if you do not call `__ReentrancyGuard_init()`, the code is:

> <https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/utils/ReentrancyGuardUpgradeable.sol#L82-L91>

The key is before reentrancy, the value can not be  
`ENTERED`(2 at here), so it does not matter if the value is 0(do not call `__ReentrancyGuard_init()`) or 1(call `__ReentrancyGuard_init()`).  
Sorry again for misleading you.  
Always write tests to verify your guesses.

---

<div class="post-metadata">

**Author:** ![Sol\_Ch](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/sol_ch/32/22084_2.png) [@Sol\_Ch](https://forum.openzeppelin.com/u/Sol_Ch)\
**Post date:** [February 14, 2025, 8:47am UTC](https://forum.openzeppelin.com/t/should-reentrancyguard-be-always-initialized-in-an-upgradable-contract-will-the-protection-work-when-not-initialized/43238/7 "2025-02-14T08:47:21Z")

</div>

@agreenberg @Skyge Thank you!