this I do not get, how would user overtake implementation and if really is possible, what he would gain, any initialisation of variables in implementation is useless as variable storage is located in proxy. For example if he initializes implementation contract setting himself as owner I mean that is useless what would he gain. upgradeTo method can only be called through proxy (onlyProxy), this immediately means proxy storage will be used as state. Can you clarify, thank you in advance.
@matadorcro Your observations sound correct. The onlyProxy modifier in UUPSUpgradeable solved the specific issue described in the linked post. But disabling initializers in the implementation would have avoided the issue in the first place.
The recommendation continues to be to disable initializers in the implementation, because in general it is better to not let anyone initialize your implementation than to let them. As mentioned above, the impact of someone initializing your implementation really depends on your code.
thank you. I think only danger is if contract has method with for example onlyOwner modifier which does selfdestruct. Then attacker could if initialize is setting owner could put himself as owner and destroy implementation contract. Probably there are more corner cases and risks per use-case.
Anycase thank you for clarifying