fix: add onlyInitializing and _disableInitializers

packages/marketplace/contracts/exchange/Exchange.sol

@@ -26,6 +26,12 @@ contract Exchange is Initializable, AccessControlUpgradeable, ExchangeCore, Tran
     /// @return hash for EXCHANGE_ADMIN_ROLE
     bytes32 public constant EXCHANGE_ADMIN_ROLE = keccak256("EXCHANGE_ADMIN_ROLE");
 
+    /// @dev this protects the implementation contract from being initialized.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /// @notice Exchange contract initializer
     /// @param admin the admin user that can grant/revoke roles, etc.
     /// @param newTrustedForwarder address for trusted forwarder that will execute meta transactions

packages/marketplace/contracts/exchange/ExchangeCore.sol

@@ -73,7 +73,7 @@ abstract contract ExchangeCore is Initializable, TransferExecutor, ITransferMana
     function __ExchangeCoreInitialize(
         IOrderValidator newOrderValidatorAddress,
         IAssetMatcher newAssetMatcher
-    ) internal {
+    ) internal onlyInitializing {
         _setOrderValidatorContract(newOrderValidatorAddress);
         _setAssetMatcherContract(newAssetMatcher);
     }

packages/marketplace/contracts/exchange/OrderValidator.sol

@@ -18,6 +18,12 @@ contract OrderValidator is IOrderValidator, Initializable, EIP712Upgradeable, Wh
 
     bytes4 internal constant MAGICVALUE = 0x1626ba7e;
 
+    /// @dev this protects the implementation contract from being initialized.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /// @notice initializer for OrderValidator
     /// @param newTsbOnly boolean to indicate that only The Sandbox tokens are accepted by the exchange contract
     /// @param newPartners boolena to indicate that partner tokens are accepted by the exchange contract

packages/marketplace/contracts/exchange/WhiteList.sol

@@ -42,6 +42,12 @@ contract WhiteList is IWhiteList, OwnableUpgradeable, AccessControlUpgradeable {
     /// @param erc20List boolean indicating that there is a restriction for ERC20 tokens
     event PermissionSetted(bool tsbOnly, bool partners, bool open, bool erc20List);
 
+    /// @dev this protects the implementation contract from being initialized.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /// @notice initializer for WhiteList
     /// @param newTsbOnly allows orders with The Sandbox token
     /// @param newPartners allows orders with partner token

packages/marketplace/contracts/royalties-registry/RoyaltiesRegistry.sol

@@ -49,6 +49,12 @@ contract RoyaltiesRegistry is IRoyaltiesProvider, OwnableUpgradeable {
     uint256 internal constant ROYALTIES_TYPE_UNSUPPORTED_NONEXISTENT = 4;
     uint256 internal constant ROYALTIES_TYPES_AMOUNT = 4;
 
+    /// @dev this protects the implementation contract from being initialized.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /// @notice Royalties registry initializer
     // solhint-disable-next-line func-name-mixedcase
     function __RoyaltiesRegistry_init() external initializer {

packages/marketplace/contracts/transfer-manager/TransferManager.sol

@@ -61,7 +61,8 @@ abstract contract TransferManager is ERC165Upgradeable, ITransferManager {
         uint256 newProtocolFeeSecondary,
         address newDefaultFeeReceiver,
         IRoyaltiesProvider newRoyaltiesProvider
-    ) internal {
+    ) internal onlyInitializing {
+        __ERC165_init();
         _setProtocolFee(newProtocolFeePrimary, newProtocolFeeSecondary);
         _setRoyaltiesRegistry(newRoyaltiesProvider);
         _setDefaultFeeReceiver(newDefaultFeeReceiver);