BabyElon Rug Pull

What the code allows:

1. The constructor gives the whole supply to the deployer and marks the owner as synced: _tokenBalances[_msgSender()] = _tokenTotalSupply; and _synced[owner()] = true;. There is no mint function and _isTradingOpen starts as false.
2. Transfers where neither side is synced are gated: if (!_synced[sender] && !_synced[recipient]) { followed by require(_isTradingOpen);. Only the owner can change that flag with function openTrading(bool value) public onlyOwner, so the owner can open or close trading for every unsynced wallet.
3. _isSwapEnabled is set to true in the constructor and has no setter, so require(sender == uniswapV2Pair || recipient == uniswapV2Pair); always applies: unsynced wallets can only trade with the pair, never send tokens wallet to wallet.
4. On a sale (recipient == uniswapV2Pair) the code runs require(!_claimed[sender], "Claimed"); and require(!_claimed[_msgSender()], "Claimed");. Through a router, sender is the holder and _msgSender() is the router, so a flagged holder cannot sell and a flagged router would block everyone using it. The flags are set by function claim(address[] calldata wallet, bool value) external onlySynced, so the owner or any wallet already synced can set them. Balances are debited exactly by amount with no fee (_tokenBalances[sender] = _tokenBalances[sender].sub(amount);), so a flagged holder keeps a balance that cannot be sold. The source does not show that any wallet was flagged.

, as listed by De.Fi's REKT database: 5. The creator paired 100M BabyElon with 10 BNB, added 290 BNB and 2.9B BabyElon, then removed the liquidity and received 484.35 BNB (listed profit 183.35 BNB) before routing the tokens through Tornado Cash. Liquidity removal is performed on the pair, outside the token code.