_disableInitializers() vs initializer vs reinitializer(uint8 version) in Openzeppelin/contracts-upgradeable?

Question

Initializable.sol provides an initializer modifier and a _disableInitializers() internal function. I need help in understanding why a _disableInitializers() might be needed if we already have a modifier which prevents the initializer function from being re-invoked.

Does this mean that the initializer function can be re-invoked in subsequent upgrades in the contract and this internal function prevents that?

Furthermore, the contract also provides a reinitializer(uint8 version) modifier. Is this supposed to be used if we are trying to initialize an upgrade contract on the older contract?

Answer 1

So I searched about it and tried these out.

And it basically is something like reinitializer(1) = initializer. You need to use reinitializer() in subsequent upgrades. _disableInitializer() just max out the version so it's not possible to again invoke any initializer.

I have summarised my findings in this blog post: https://abhik.hashnode.dev/6-nuances-of-using-upgradeable-smart-contracts

Answer 2

_disableInitializers() is called inside the constructor. This is done so that in the context of the logic contract the initializer is locked. Therefore any attacker will not able to call the initalizer() function in the state of the logic contract and perform any malicious activity. Note that the proxy contract state will still be able to call this function, this is because the constructor does not effect the state of the proxy contract. Hope this helps.