fix: possible reinitialization

src/contracts/vault/v1.1/Implementation.sol

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity 0.8.25;
+
+import {IImplementation} from "../../../interfaces/vault/v1.1/IImplementation.sol";
+
+contract Implementation is IImplementation {
+    address private immutable FACTORY;
+
+    modifier onlyFactory() {
+        _isFactory();
+        _;
+    }
+
+    constructor(
+        address factory
+    ) {
+        FACTORY = factory;
+    }
+
+    function _isFactory() internal view {
+        if (msg.sender != FACTORY) {
+            revert NotFactory();
+        }
+    }
+}

src/contracts/vault/v1.1/VaultImplementation.sol

@@ -2,6 +2,7 @@
 pragma solidity 0.8.25;
 
 import {VaultStorage} from "./VaultStorage.sol";
+import {Implementation} from "./Implementation.sol";
 
 import {IBaseDelegator} from "../../../interfaces/delegator/IBaseDelegator.sol";
 import {IBaseSlasher} from "../../../interfaces/slasher/IBaseSlasher.sol";
@@ -20,7 +21,13 @@ import {Time} from "@openzeppelin/contracts/utils/types/Time.sol";
 import {IERC3156FlashBorrower} from "@openzeppelin/contracts/interfaces/IERC3156FlashBorrower.sol";
 import {IERC3156FlashLender} from "@openzeppelin/contracts/interfaces/IERC3156FlashLender.sol";
 
-contract VaultImplementation is VaultStorage, AccessControlUpgradeable, ReentrancyGuardUpgradeable, IVault {
+contract VaultImplementation is
+    VaultStorage,
+    Implementation,
+    AccessControlUpgradeable,
+    ReentrancyGuardUpgradeable,
+    IVault
+{
     using Checkpoints for Checkpoints.Trace256;
     using Math for uint256;
     using Math for uint48;
@@ -37,7 +44,7 @@ contract VaultImplementation is VaultStorage, AccessControlUpgradeable, Reentran
      */
     address public immutable SLASHER_FACTORY;
 
-    constructor(address delegatorFactory, address slasherFactory) {
+    constructor(address vaultFactory, address delegatorFactory, address slasherFactory) Implementation(vaultFactory) {
         DELEGATOR_FACTORY = delegatorFactory;
         SLASHER_FACTORY = slasherFactory;
     }
@@ -719,5 +726,5 @@ contract VaultImplementation is VaultStorage, AccessControlUpgradeable, Reentran
 
     function _Vault_init(
         bytes calldata /* data */
-    ) external {}
+    ) external onlyFactory {}
 }

src/contracts/vault/v1.1/VaultTokenizedImplementation.sol

@@ -2,6 +2,7 @@
 pragma solidity 0.8.25;
 
 import {VaultStorage} from "./VaultStorage.sol";
+import {Implementation} from "./Implementation.sol";
 
 import {IVault} from "../../../interfaces/vault/v1.1/IVault.sol";
 import {IVaultTokenized} from "../../../interfaces/vault/v1.1/IVaultTokenized.sol";
@@ -19,6 +20,7 @@ import {Address} from "@openzeppelin/contracts/utils/Address.sol";
 
 contract VaultTokenizedImplementation is
     VaultStorage,
+    Implementation,
     ERC20Upgradeable,
     ReentrancyGuardUpgradeable,
     Proxy,
@@ -29,9 +31,7 @@ contract VaultTokenizedImplementation is
 
     address private immutable BASE_IMPLEMENTATION;
 
-    constructor(
-        address baseImplementation
-    ) {
+    constructor(address vaultFactory, address baseImplementation) Implementation(vaultFactory) {
         BASE_IMPLEMENTATION = baseImplementation;
     }
 
@@ -136,7 +136,7 @@ contract VaultTokenizedImplementation is
 
     function _VaultTokenized_init(
         bytes calldata data
-    ) external {
+    ) external onlyFactory {
         (string memory name, string memory symbol) = abi.decode(data, (string, string));
 
         __ERC20_init(name, symbol);

src/contracts/vault/v1.1/VaultVotesImplementation.sol

@@ -23,8 +23,9 @@ contract VaultVotesImplementation is VaultTokenizedImplementation, VotesUpgradea
     using Address for address;
 
     constructor(
+        address vaultFactory,
         address baseImplementation
-    ) VaultTokenizedImplementation(baseImplementation) {}
+    ) VaultTokenizedImplementation(vaultFactory, baseImplementation) {}
 
     /**
      * @inheritdoc IERC6372
@@ -108,7 +109,7 @@ contract VaultVotesImplementation is VaultTokenizedImplementation, VotesUpgradea
 
     function _VaultVotes_init(
         bytes calldata /* data */
-    ) external {
+    ) external onlyFactory {
         __EIP712_init("VaultVotes", "1");
     }
 }

src/interfaces/vault/v1.1/IImplementation.sol

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+interface IImplementation {
+    error NotFactory();
+}

src/interfaces/vault/v1.1/IVault.sol

@@ -2,12 +2,13 @@
 pragma solidity ^0.8.0;
 
 import {IVaultStorage} from "./IVaultStorage.sol";
+import {IImplementation} from "./IImplementation.sol";
 
 import {IAccessControl} from "@openzeppelin/contracts/access/IAccessControl.sol";
 import {IERC165} from "@openzeppelin/contracts/interfaces/IERC165.sol";
 import {IERC3156FlashLender} from "@openzeppelin/contracts/interfaces/IERC3156FlashLender.sol";
 
-interface IVault is IVaultStorage, IAccessControl, IERC165, IERC3156FlashLender {
+interface IVault is IVaultStorage, IImplementation, IAccessControl, IERC165, IERC3156FlashLender {
     error AlreadyClaimed();
     error AlreadySet();
     error DelegatorAlreadyInitialized();

src/interfaces/vault/v1.1/IVaultTokenized.sol

@@ -1,11 +1,13 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.0;
 
+import {IImplementation} from "./IImplementation.sol";
+
 import {IERC20Errors} from "@openzeppelin/contracts/interfaces/draft-IERC6093.sol";
 import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 
-interface IVaultTokenized is IERC20, IERC20Metadata, IERC20Errors {
+interface IVaultTokenized is IImplementation, IERC20, IERC20Metadata, IERC20Errors {
     /**
      * @notice Initial parameters needed for a tokenized vault deployment.
      * @param baseParams initial parameters needed for a vault deployment (abi.encode(IVault.InitParams))

test/vault/v1.1/Vault.t.sol

@@ -102,7 +102,7 @@ contract VaultTest is Test {
         vaultFactory.whitelist(vaultTokenizedV1Impl);
 
         address vaultImplementation =
-            address(new VaultImplementation(address(delegatorFactory), address(slasherFactory)));
+            address(new VaultImplementation(address(vaultFactory), address(delegatorFactory), address(slasherFactory)));
         address vaultImpl = address(new Vault(address(vaultFactory), vaultImplementation));
         vaultFactory.whitelist(vaultImpl);
 

test/vault/v1.1/VaultTokenized.t.sol

@@ -102,11 +102,12 @@ contract VaultTokenizedTest is Test {
         vaultFactory.whitelist(vaultTokenizedV1Impl);
 
         address vaultImplementation =
-            address(new VaultImplementation(address(delegatorFactory), address(slasherFactory)));
+            address(new VaultImplementation(address(vaultFactory), address(delegatorFactory), address(slasherFactory)));
         address vaultImpl = address(new Vault(address(vaultFactory), vaultImplementation));
         vaultFactory.whitelist(vaultImpl);
 
-        address vaultTokenizedImplementation = address(new VaultTokenizedImplementation(vaultImplementation));
+        address vaultTokenizedImplementation =
+            address(new VaultTokenizedImplementation(address(vaultFactory), vaultImplementation));
         address vaultTokenizedImpl = address(new VaultTokenized(address(vaultFactory), vaultTokenizedImplementation));
         vaultFactory.whitelist(vaultTokenizedImpl);
 

test/vault/v1.1/VaultVotes.t.sol

@@ -105,15 +105,17 @@ contract VaultVotesTest is Test {
         vaultFactory.whitelist(vaultTokenizedV1Impl);
 
         address vaultImplementation =
-            address(new VaultImplementation(address(delegatorFactory), address(slasherFactory)));
+            address(new VaultImplementation(address(vaultFactory), address(delegatorFactory), address(slasherFactory)));
         address vaultImpl = address(new Vault(address(vaultFactory), vaultImplementation));
         vaultFactory.whitelist(vaultImpl);
 
-        address vaultTokenizedImplementation = address(new VaultTokenizedImplementation(vaultImplementation));
+        address vaultTokenizedImplementation =
+            address(new VaultTokenizedImplementation(address(vaultFactory), vaultImplementation));
         address vaultTokenizedImpl = address(new VaultTokenized(address(vaultFactory), vaultTokenizedImplementation));
         vaultFactory.whitelist(vaultTokenizedImpl);
 
-        address vaultVotesImplementation = address(new VaultVotesImplementation(vaultImplementation));
+        address vaultVotesImplementation =
+            address(new VaultVotesImplementation(address(vaultFactory), vaultImplementation));
         address vaultVotesImpl = address(new VaultVotes(address(vaultFactory), vaultVotesImplementation));
         vaultFactory.whitelist(vaultVotesImpl);