ANT Token Rug Pull

What the code allows:

1. The constructor mints the whole supply to the deployer (_totalSupply = initNumber * 10**decimals(); with initNumber = 500 * 10**4, _balances[msg.sender] = _totalSupply;) and creates the pool pair with createPair(address(this), address(usdtAddress)). Liquidity itself is added outside the token contract, so the code does not lock or hold the LP tokens.
2. Any transfer between the pair and a non-whitelisted address is taxed by four fee lines such as uint256 feeAmount = (amount * lpRate) / 10000;. The sender is debited the full amount (_balances[from] = fromBalance - amount;) while the recipient receives toAmount after the fees are subtracted. The defaults are 200 + 50 + 150 + 100 = 500 basis points (5%).
3. setRates is onlyOwner and has no cap. If the four rates sum to 10000, toAmount becomes 0 and the receiving side of a buy or sell gets nothing; above that, toAmount = toAmount - feeAmount; underflows and the transfer reverts under Solidity 0.8.17. The owner can exempt an address from this with addFeeWhitelist.
4. changePancakeSetting(bool _openPancake, uint256 _minPancakeCount) is onlyOwner. With openPancake set to false, buys require isPancakeWhitelist(to) and sells require require(isPancakeWhitelist(from), "Not on the whitelist");, and the owner controls that list through addPancakeWhitelist. The constructor starts with openPancake = true.

What was reported:

5. CertiK Alert reported a price drop of more than 95% on 2023-04-17 and about 36k BSC-USD sent to 0x2c15a4d6…d1a7b6; De.Fi's REKT database lists 36,496 USD drained from the pool by a deployer-related EOA. No transaction was opened for this record, so which mechanism removed the funds (LP removal or a fee or trading-switch change) is not established.