Aphrodite Protocol Rug Pull

What the code allows (the sources do not show which owner functions were called):

1. The constructor assigns the whole supply to the deployer: _reflectionBalance[_msgSender()] = _reflectionTotal; with _tokenTotal = 69_000e18, and marks the deployer and the token contract fee-exempt (isExcludedFromFee[_msgSender()] = true;).
2. Before tradingEnabled is set, only the owner and fee-exempt addresses can trade: require(tradingEnabled || sender == owner() || recipient == owner() || isExcludedFromFee[sender] || isExcludedFromFee[recipient], "Trading is locked before presale.");. enableTrading() is onlyOwner and one-way; there is no function that locks trading again.
3. Fees are owner-adjustable with no upper bound: setTaxFee(uint256 fee) and setLiquidityFee(uint256 fee) assign the value directly, and collectFee computes amount.mul(_taxFee).div(10**(_feeDecimal + 2)) with _feeDecimal = 1, so the defaults of 5 and 5 are 0.5% each. In _transfer the sender is debited amount.mul(rate) while the recipient is credited transferAmount.mul(rate), so the fee comes out of what the buyer or the pool receives; a combined value near 1000 would leave transfers with almost nothing, and a combined value above 1000 would make transferAmount.sub(...) revert.
4. setExcludedFromFee lets the owner exempt chosen addresses from those fees, and excludeAccount / includeAccount change which addresses are reflection-excluded.
5. Collected fee tokens sit in the contract and are swapped to ETH with 0 minimum output; the ETH stays in the contract and is used to buy and burn tokens, with _rebalanceCallerFee = 500 (50% of the bought tokens) paid to tx.origin of the transaction that triggers it. No function sends the contract's ETH to the owner.
6. renounceOwnership exists in Ownable; the current on-chain owner() read still returns the deployer address.

What was reported:

7. De.Fi lists the sequence as a Telegram fundraising announcement, deposits sent directly to the deployer address, initial liquidity added by the deployer in transaction 0xf0cc8a57…077bdb and removed by the deployer in transaction 0x93245437…6d2f8d, with 97,147 USD lost. Rug Detectives flagged the project as a scam on 2020-12-29.