SUI Token Rug Pull

What the code allows (the sources do not show which of these functions was called):

1. The constructor mints the whole initial supply to the deployer: _mint(_msgSender(), 100000000 * 10 ** decimals());. The deployer is the first owner, and renounceOwnership and transferOwnership are the standard Ownable functions; the current on-chain owner is still 0x35a93566…7fd5b5.
2. mint(address to, uint256 amount) public onlyOwner calls _mint(to, amount), so the owner can create any quantity of SUI at any time. There is no cap.
3. drainLP(address token, uint32 k) public onlyOwner looks up the SUI/token pair, then runs _mint(address(pair), amountIn); pair.swap(0, amountOut, _msgSender(), ""); where amountOut = uint256(reserveB) * k / 10000. The freshly minted SUI is the "input" of the swap, so the pair pays out a share of its paired-asset reserve to the owner without the owner supplying any value. It then calls _burn(address(pair), amountIn + uint256(reserveA) * k / 10000) and pair.sync(), which also removes part of the pair's original SUI reserve.
4. rebaseLP(address token, uint32 k) public onlyOwner sets the pair's SUI balance to currentBalance * k / 10000 by burning from or minting to address(pair), then calls pair.sync(). This lets the owner reset the pool price at will without holding LP tokens.
5. Every transfer, including mints and burns, calls _warden.registerTransfer(from, to, amount) from _beforeTokenTransfer. The warden contract address is a constructor argument and its code is not part of the verified source, so whether it can block transfers cannot be determined from this evidence.

What was reported:

6. On 2023-02-06, CertiK Alert reported a large liquidity removal on the token, about $100.2k removed from the pool and about $32k sent to Tornado Cash. De.Fi lists the deployer-side removal as a rug pull with a roughly 90% price drop.