DarkProtocol Rug Pull

What the code allows (from the verified source):

1. The token contract has no balance mapping. balanceOf reads from another contract: return Accounting(accounting).balanceOf(who);. The constructor only emits a mint event (emit Transfer(address(0), msg.sender, _totalSupply); with _totalSupply = 1000000 * 10 ** 9;) and never writes a balance.
2. Every move of tokens is delegated: transfer runs return Accounting(accounting).doTransfer(msg.sender, msg.sender, to, amount); and transferFrom runs return Accounting(accounting).doTransfer(msg.sender, from, to, amount);. The Transfer event is emitted before the call, so the log shows a transfer regardless of what the accounting contract does with the balances. That contract can approve, reject, charge or ignore any transfer, including a sell into the pair, and it is not part of the verified source.
3. The owner chooses that contract: function setAccountingAddress(address accountingAddress) public { require(msg.sender == owner); accounting = accountingAddress; }. While the owner holds the role it can point accounting at any contract at any time.
4. The owner role can be given up: function renounceOwnership() public { require(msg.sender == owner); ... owner = address(0); }. A current read of the chain shows owner as the zero address, so ownership has been renounced at some point; which transaction did this, and what accounting pointed to when it did, was not checked. After renouncing, accounting can no longer be changed, but the code the address points to still decides every balance and transfer.

(reported by PeckShield Alert and the De.Fi listing):

5. PeckShield Alert posted that DarkProtocol $DARK had dropped 100%, that address 0xb880...0832 swapped 100,100,100,100,100,100,100.1001 DARK for 976.53 WBNB (about $230.8K), and that the rugpull token may share a name with legitimate projects. That DARK amount is far above the 1,000,000 DARK _totalSupply set in the constructor, which fits balances being decided by the external accounting contract rather than by the token's own supply; the accounting contract was not read.
6. De.Fi's listing says the deployer removed liquidity worth 174,334 USD (737.52 WBNB) from the PancakeSwap pool and moved the funds to another EOA, from which they were spread across multiple addresses. The liquidity add and removal transactions were not opened here.