Block Chain Games Rug Pull

What the code allows:

1. The deployed contract is a proxy. address public implementation; stores the logic address, and fallback() external payable virtual { _fallback(); } forwards every call that is not defined in the proxy through delegatecall(gas(), implementation_, 0, calldatasize(), 0, 0). Balances, transfers and minting therefore run in the implementation, which is not part of the verified source.
2. The owner controls the logic: function setImplementation(address __implementation) public onlyOwner { implementation = __implementation; }. There is no timelock, multisig or cap, so the owner can point the token at logic that includes a mint or any other privileged function.
3. onlyOwner checks require(owner() == msg.sender, "Ownable: caller is not the owner"), and owner() on-chain is the deployer's address, so one key holds this power. renounceOwnership() exists but the on-chain read in meta.json shows an owner still set.

What was reported to have happened:

4. Beosin Alert says the owner called a privileged function with selector 0x25bbb5ae to mint a large amount of BCGA.
5. The same alert says the minted tokens were immediately swapped for 128.45 BNB (about 39,092 USD), and De.Fi lists the loss as 39,686 USD and the minted amount as 10,000,000,000,000,000,000 BCGA. The mint function's source is in the unseen implementation, so the code evidence shown here proves the owner's ability to supply such logic, not the exact mint code.