To get a max-uint256 allowance, the token holder must have explicitly called approve() themselves first. The spender doesn't get it for free.
Our HoodPadToken.sol is vanilla OpenZeppelin ERC-20 β no custom transfer logic, no owner, no mint after construction, no blacklist. Nothing we wrote causes this.
This warning applies to literally every ERC-20 token on every chain.
LP locking is a completely separate thing
The LP is a Uniswap V3 NFT position (tokenId), not ERC-20 tokens. After launch, the factory transfers that NFT into HoodPadLockerV2 / HoodPadLockerV3. Nobody can withdraw it β the locker has no withdraw function. The warning above has zero connection to LP locking.