fix: ensure contracts are only initialized once (C4 M-149)

Author: pcarranzav

contracts/gateway/BridgeEscrow.sol

@@ -2,6 +2,8 @@
 
 pragma solidity ^0.7.6;
 
+import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/Initializable.sol";
+
 import "../upgrades/GraphUpgradeable.sol";
 import "../governance/Managed.sol";
 import "../token/IGraphToken.sol";
@@ -12,12 +14,12 @@ import "../token/IGraphToken.sol";
  * a set of spenders that can transfer the tokens; the L1 side of each L2 bridge has to be
  * approved as a spender.
  */
-contract BridgeEscrow is GraphUpgradeable, Managed {
+contract BridgeEscrow is Initializable, GraphUpgradeable, Managed {
     /**
      * @dev Initialize this contract.
      * @param _controller Address of the Controller that manages this contract
      */
-    function initialize(address _controller) external onlyImpl {
+    function initialize(address _controller) external onlyImpl initializer {
         Managed._initialize(_controller);
     }
 

contracts/gateway/L1GraphTokenGateway.sol

@@ -3,6 +3,7 @@
 pragma solidity ^0.7.6;
 pragma abicoder v2;
 
+import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/Initializable.sol";
 import "@openzeppelin/contracts/utils/Address.sol";
 import "@openzeppelin/contracts/math/SafeMath.sol";
 
@@ -18,7 +19,7 @@ import "./GraphTokenGateway.sol";
  * (See: https://github.com/OffchainLabs/arbitrum/tree/master/packages/arb-bridge-peripherals/contracts/tokenbridge
  * and https://github.com/livepeer/arbitrum-lpt-bridge)
  */
-contract L1GraphTokenGateway is GraphTokenGateway, L1ArbitrumMessenger {
+contract L1GraphTokenGateway is Initializable, GraphTokenGateway, L1ArbitrumMessenger {
     using SafeMath for uint256;
 
     // Address of the Graph Token contract on L2
@@ -97,7 +98,7 @@ contract L1GraphTokenGateway is GraphTokenGateway, L1ArbitrumMessenger {
      * - pauseGuardian using setPauseGuardian
      * @param _controller Address of the Controller that manages this contract
      */
-    function initialize(address _controller) external onlyImpl {
+    function initialize(address _controller) external onlyImpl initializer {
         Managed._initialize(_controller);
         _paused = true;
     }

contracts/l2/gateway/L2GraphTokenGateway.sol

@@ -84,7 +84,7 @@ contract L2GraphTokenGateway is GraphTokenGateway, L2ArbitrumMessenger, Reentran
      * - pauseGuardian using setPauseGuardian
      * @param _controller Address of the Controller that manages this contract
      */
-    function initialize(address _controller) external onlyImpl {
+    function initialize(address _controller) external onlyImpl initializer {
         Managed._initialize(_controller);
         _paused = true;
         __ReentrancyGuard_init();

contracts/l2/token/L2GraphToken.sol

@@ -45,7 +45,7 @@ contract L2GraphToken is GraphTokenUpgradeable, IArbToken {
      * - l1Address using setL1Address
      * @param _owner Governance address that owns this contract
      */
-    function initialize(address _owner) external onlyImpl {
+    function initialize(address _owner) external onlyImpl initializer {
         require(_owner != address(0), "Owner must be set");
         // Initial supply hard coded to 0 as tokens are only supposed
         // to be minted through the bridge.