Kusunoki Samurai - Audit 2

In the contract `Kusunoki` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and add/remove user from blacklist, pause/unpause the contract, update Uniswap pool address and set lock date. -Kusunoki-_owner.svg) In the contract `OwnableUpgradeable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer/renounce ownership. -OwnableUpgradeable-_owner.svg)

In the contract Kusunoki, the role `admin` has the authority to update the implementation contract behind the proxy contract. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.

All of the KUS tokens are sent to the contract deployer. This is a centralization risk because the deployer can distribute tokens without obtaining the consensus of the community. Any compromise to the deployer address may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

function `_beforeTokenTransfer` restricts anyone to transfer KUS token from the pool before `_lockedDate`, which means that users cannot purchase tokens nor can they remove liquidity. Currently, `_lockedDate` is hardcoded to `1763250300` which is roughly November 2025.