Initialize function in BaseBranchRouter.sol, BranchPort.sol, CoreRootRouter.sol, MulticallRootRouter.sol, RootPort.sol, ArbitrumBranchBridgeAgentFactory.sol, BranchBridgeAgentFactory.sol, ERC20hTokenBranchFactory.sol, ERC20hTokenRootFactory.sol can be invoked multiple times from the implementation contract
Audit: 2023-09-maia-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2023-09-maia/blob/main/src/BaseBranchRouter.sol#L60
https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L122
https://github.com/code-423n4/2023-09-maia/blob/main/src/CoreRootRouter.sol#L83
https://github.com/code-423n4/2023-09-maia/blob/main/src/MulticallRootRouter.sol#L109
https://github.com/code-423n4/2023-09-maia/blob/main/src/RootPort.sol#L129
https://github.com/code-423n4/2023-09-maia/blob/main/src/factories/ArbitrumBranchBridgeAgentFactory.sol#L56
https://github.com/code-423n4/2023-09-maia/blob/main/src/factories/BranchBridgeAgentFactory.sol#L87
https://github.com/code-423n4/2023-09-maia/blob/main/src/factories/ERC20hTokenBranchFactory.sol#L60
https://github.com/code-423n4/2023-09-maia/blob/main/src/factories/ERC20hTokenRootFactory.sol#L49


# Vulnerability details

## Impact
Initialize function in BaseBranchRouter.sol, BranchPort.sol, CoreRootRouter.sol, MulticallRootRouter.sol, RootPort.sol, ArbitrumBranchBridgeAgentFactory.sol, BranchBridgeAgentFactory.sol, ERC20hTokenBranchFactory.sol, ERC20hTokenRootFactory.sol can be invoked multiple times from the implementation contract. This means a compromised implementation can reinitialize the contract above and become the owner to complete the privilege escalation then drain the user’s fund.

Usually in Upgradeable contract, an initialize function is protected by the modifier

 `initializer`

to make sure the contract can only be initialized once.

## Proof of Concept
```solidity
File: src/BaseBranchRouter.sol

60:     function initialize(address _localBridgeAgentAddress) external onlyOwner {

```

```solidity
File: src/BranchPort.sol

122:     function initialize(address _coreBranchRouter, address _bridgeAgentFactory) external virtual onlyOwner {

```

```solidity
File: src/CoreRootRouter.sol

83:     function initialize(address _bridgeAgentAddress, address _hTokenFactory) external onlyOwner {

```

```solidity
File: src/MulticallRootRouter.sol

109:     function initialize(address _bridgeAgentAddress) external onlyOwner {

```

```solidity
File: src/RootPort.sol

129:     function initialize(address _bridgeAgentFactory, address _coreRootRouter) external onlyOwner {

```

```solidity
File: src/factories/ArbitrumBranchBridgeAgentFactory.sol

56:     function initialize(address _coreRootBridgeAgent) external override onlyOwner {

```

```solidity
File: src/factories/BranchBridgeAgentFactory.sol

87:     function initialize(address _coreRootBridgeAgent) external virtual onlyOwner {

```

```solidity
File: src/factories/ERC20hTokenBranchFactory.sol

60:     function initialize(address _wrappedNativeTokenAddress, address _coreRouter) external onlyOwner {

```

```solidity
File: src/factories/ERC20hTokenRootFactory.sol

49:     function initialize(address _coreRouter) external onlyOwner {

```

## Tools Used
VS Code

## Recommended Mitigation Steps
We recommend the project use the modifier `initializer` to protect the initialize func