evm: Enforce initializer on the transceivers as well

evm/src/Transceiver/Transceiver.sol

@@ -22,10 +22,12 @@ abstract contract Transceiver is
     /// contract address and then add the new one.
     address public immutable nttManager;
     address public immutable nttManagerToken;
+    address immutable deployer;
 
     constructor(address _nttManager) {
         nttManager = _nttManager;
         nttManagerToken = INttManager(nttManager).token();
+        deployer = msg.sender;
     }
 
     /// =============== MODIFIERS ===============================================
@@ -40,6 +42,11 @@ abstract contract Transceiver is
     /// =============== ADMIN ===============================================
 
     function _initialize() internal virtual override {
+        // check if the owner is the deployer of this contract
+        if (msg.sender != deployer) {
+            revert UnexpectedDeployer(deployer, msg.sender);
+        }
+
         __ReentrancyGuard_init();
         // owner of the transceiver is set to the owner of the nttManager
         __PausedOwnable_init(msg.sender, getNttManagerOwner());

evm/src/interfaces/ITransceiver.sol

@@ -4,6 +4,8 @@ pragma solidity >=0.8.8 <0.9.0;
 import "../libraries/TransceiverStructs.sol";
 
 interface ITransceiver {
+    /// @notice The caller is not the deployer.
+    error UnexpectedDeployer(address deployer, address caller);
     error CallerNotNttManager(address caller);
     error CannotRenounceTransceiverOwnership(address currentOwner);
     error CannotTransferTransceiverOwnership(address currentOwner, address newOwner);

evm/test/IntegrationStandalone.t.sol

@@ -8,6 +8,7 @@ import "../src/NttManager/NttManager.sol";
 import "../src/Transceiver/Transceiver.sol";
 import "../src/interfaces/INttManager.sol";
 import "../src/interfaces/IRateLimiter.sol";
+import "../src/interfaces/ITransceiver.sol";
 import "../src/interfaces/INttManagerEvents.sol";
 import "../src/interfaces/IRateLimiterEvents.sol";
 import {Utils} from "./libraries/Utils.sol";
@@ -80,6 +81,15 @@ contract TestEndToEndBase is Test, INttManagerEvents, IRateLimiterEvents {
         wormholeTransceiverChain1 = MockWormholeTransceiverContract(
             address(new ERC1967Proxy(address(wormholeTransceiverChain1Implementation), ""))
         );
+
+        // Only the deployer should be able to initialize
+        vm.prank(userA);
+        vm.expectRevert(
+            abi.encodeWithSelector(ITransceiver.UnexpectedDeployer.selector, address(this), userA)
+        );
+        wormholeTransceiverChain1.initialize();
+
+        // Actually initialize properly now
         wormholeTransceiverChain1.initialize();
 
         nttManagerChain1.setTransceiver(address(wormholeTransceiverChain1));