Incorrect Constructor

1. Check the Solidity version: if >=0.4.22 and the constructor keyword is used, this vulnerability does not apply
2. For <0.4.22 contracts: find the function that sets initial state (owner, parameters) and verify its name exactly matches the contract name (case-sensitive)
3. Search for public/external functions that set owner or perform one-time initialization — these may be misnamed constructors
4. Check if the contract was renamed at any point (git history, comments) but the constructor function was not updated
5. Flag any named function that appears to perform initialization logic (sets owner, initializes critical state) but doesn't match the contract name

False Positives

• Solidity >=0.4.22 using the constructor keyword (enforced by compiler)
• The function is intentionally a public initializer (e.g., in proxy patterns) with proper access control

Remediation

• Upgrade to Solidity >=0.4.22 and use the constructor keyword
• For legacy contracts, verify the constructor function name exactly matches the contract name

// Modern Solidity: compiler-enforced constructor
contract Owned {
    address public owner;

    constructor() {
        owner = msg.sender;
    }
}