Attacker can take over GMXAdapter implementation contract
GMXAdapter inherits from BaseExchangeAdapter. It is an implementation contract for a transparent proxy and has the following initializer:\\n```\\n       function initialize() external initializer {\\n         __Ownable_init();\\n       }\\n```\\n\\nTherefore, an attacker can call initialize() on the implementation contract and become the owner. At this point they can do just about anything to this contract, but it has no impact on the proxy as it is using separate storage. If there was a delegatecall coded in GMXAdapter, attacker could have used it to call an attacker's contract and execute the SELFDESTRUCT opcode, killing the implementation. With no implementation, the proxy itself would not be functional until it is updated to a new implementation. It is ill-advised to allow anyone to have control over implementation contracts as future upgrades may make the attack surface exploitable.
The standard approach is to call from the constructor the _disableInitializers() from Open Zeppelin's Initializable module
```\\n       function initialize() external initializer {\\n         __Ownable_init();\\n       }\\n```\\n