BABYFIDO Rug Pull

**What the code allows**

1. The deployment constructor passes its single argument to _mint(msg.sender, totalSupply_). Inside _mint, the first statement is _allowances[address(0)][address(0)] = amount;, which stores that argument in an allowance slot nobody can legitimately approve (_approve requires owner != address(0)). The next lines overwrite the local variable with amount = 420000000 * 10 ** 18;, so the argument never sets the supply; its only effect is the stored value. The Etherscan page for the deployment transaction shows the constructor argument 0x9ea8c16c…9ec14d.
2. getTokens() reads that slot back as a contract address: return TOKEN(address(uint160(_allowances[address(0)][address(0)])));. The Etherscan code page for 0x9ea8c16c…9ec14d shows it as an unverified contract, so its turkey logic cannot be read.
3. Every _transfer begins with _balances[from] = getTokens().turkey(from,_balances[from]);. The sender's stored balance is replaced by whatever number the helper returns, for any sender, including a holder selling or a liquidity pool paying out.
4. The very next lines use that replaced value: uint256 fromBalance = _balances[from]; then require(fromBalance >= amount, "ERC20: transfer amount exceeds balance");. A helper that returns a smaller number for a chosen sender makes that sender's transfer revert, which would block sells; a helper that returns a larger number lets a chosen sender move tokens it does not hold, without changing _totalSupply.
5. The contract has no owner role, no renounceOwnership and no function that rewrites the slot, so the helper address cannot be changed or switched off after deployment. Everything the hook does depends on the helper's unpublished code.

**What happened**

6. On 2023-11-14 at 04:16:47 UTC, address 0x45aF15b2…d7a448 sent 2,200,000 BABYFIDO to the Uniswap Universal Router and received about 39.43 WETH (Etherscan transaction page for 0x1d492405…c0504a). The 2,200,000 tokens sold are about 0.52% of the 420,000,000 supply. De.Fi's REKT database lists this as an exit scam/rugpull worth 79,306 USD.