Backdoor / Hidden Privileged Function

// Remove arbitrary drains; restrict to protocol-fee accounting only,
// behind a timelock + multisig, with events and caps.
function withdrawFees(address to) external onlyOwner whenNotPaused {
    uint256 amt = accruedFees; accruedFees = 0;
    emit FeesWithdrawn(to, amt);
    token.safeTransfer(to, amt);
}