Remediating Immutable Violation

Overview

Related Detector: Immutable Violation

Variables that should not change after deployment should use Solidity’s immutable keyword. For proxy patterns where immutable cannot be used, implement initialization guards.

Recommended Fix

Before (Vulnerable)

address public oracle; // Mutable — can be changed after deployment

constructor(address _oracle) {
    oracle = _oracle;
}

After (Fixed)

address public immutable oracle; // Cannot be changed after construction

constructor(address _oracle) {
    oracle = _oracle;
}

Alternative Mitigations

• Initialization guard for proxies: Use OpenZeppelin’s Initializable with initializer modifier to ensure one-time execution.
• Constant values: For values known at compile time, use constant instead of immutable.

Common Mistakes

• Using immutable in proxy implementations: Immutable values are stored in the bytecode, not storage. In proxy patterns, the proxy’s bytecode is different from the implementation’s, so immutable in the implementation does not affect the proxy.

References

• Solidity — Immutable
• OpenZeppelin Initializable