OpenZeppelin Contracts initializer reentrancy may lead to double initialization

CVE-2022-39384 is a reentrancy vulnerability in OpenZeppelin Contracts versions 3.2.0 through 4.4.0. Initializer functions, when invoked separately from contract creation (e.g., via minimal proxies), could be reentered if they make an untrusted non-view external call. The root cause is an exception in the initializer modifier designed to support multiple inheritance, which inadvertently allowed nested initializer calls after the initial execution had completed [1][3].

To exploit this, an attacker must cause an initializer function to make an untrusted external call during its execution. This is feasible in scenarios where initialization occurs after contract deployment, such as with minimal proxies. Upgradeable proxies initialized together with contract creation are less exposed because reentrancy is not feasible in that context [3].

The impact is that an initializer could be executed twice, breaking the guarantee of single initialization. While considered minor, double initialization could lead to unexpected contract state. The issue is patched in version 4.4.1, and the workaround is to avoid untrusted external calls during initialization [1][4].