Changpeng Zhao Rug Pull

What the code allows:

1. The constructor mints 1_000_000_000 * 1e18 CZ to the deployer with _mint(msg.sender, totalSupply), and the deployer address is also set as marketingWallet and devWallet.
2. It sets the sell fee to uint256 _sellMarketingFee = 1000; and the buy fee to 0, so sellTotalFees is 1000.
3. In _transfer, a transfer into an automatedMarketMakerPairs address by a wallet that is not fee-excluded computes fees = amount.mul(sellTotalFees).div(100);, which equals 10 times amount. The contract then executes super._transfer(from, address(this), fees); followed by amount -= fees;. Because fees exceeds amount, the subtraction underflows and the whole sale reverts (and if the seller's balance is below 10 times amount, the fee transfer reverts first). Ordinary wallet-to-wallet transfers and buys (fee 0) are not affected, so holders can receive CZ but cannot sell it into the pool.
4. excludeFromFees(owner(), true) in the constructor skips the fee branch for the deployer (if (_isExcludedFromFees[from] || _isExcludedFromFees[to]) { takeFee = false; }), so a sale by the deployer goes through at full amount.
5. function mint(address to, uint256 amount) external onlyOwner { _mint(to, amount); } lets the owner create further tokens without a cap. updateSellFees can also change the sell fee, but is limited to require(sellTotalFees <= 100, ...), i.e. at most 100%.

, per the listings:

6. On 2023-11-24, per De.Fi, the deployer removed liquidity from the PancakeSwap pool in multiple transactions and sold a large number of tokens, taking 1,934.17 WBNB (454,168 USD). PeckShield reported that 0xCC78A249…C2f66C swapped 992,035,763,183.91 CZ for 1,290.55 WBNB, which is more than the 1,000,000,000 CZ minted in the constructor. No mint transaction was opened for this review, so the source of the extra tokens is not established.
7. De.Fi says the funds were sent to another EOA and then distributed among several addresses.