DeFi Safe Rug Pull

Steps 1 to 4 describe what the verified code allows; steps 5 and 6 are what was reported.

1. The constructor gives the whole supply to the deployer, who is also the Ownable owner: _rOwned[_msgSender()] = _rTotal;. The deployer therefore controls the initial liquidity it adds and holds the resulting LP position.
2. The owner can stop any holder from sending tokens. _transfer begins with require(!_isBlacklist[from], "BEP20: transfer from blacklisted address");, and addToBlacklist(address account) external onlyOwner sets the flag. The check is on from, which is the holder in both transfer and transferFrom, so a blacklisted holder cannot sell through the router. Only the owner cannot be blacklisted: require(account != owner(), "BEP20: can not blacklist owner");.
3. The owner can also tighten limits on everyone else. Non-excluded sellers must pass require(amount <= _sMaxTxAmount, "Transfer amount exceeds the max sell amount.");, and setSellMaxTxAmount(uint256 sMaxTxAmount) external onlyOwner has no lower bound. setSellFee(uint256 sellTaxFee, uint256 sellVaultFee, uint256 sellLiquidityFee) external onlyOwner likewise has no upper bound, and setTradingOpen(bool _status) can pause trading for non-excluded addresses.
4. Nothing in the token locks or burns the liquidity. LP tokens for the pair belong to whoever added the liquidity, and removing it is an ordinary router call outside this contract. renounceOwnership() exists but is optional, and the on-chain read of 2026-09-30 still shows the deployer as owner.
5. Reported: CertiK Alert's post of 2022-11-07 says the contract creator blacklisted holder EOAs and then removed liquidity for about $127k, with the token down more than 99%.
6. Reported: De.Fi's listing says the liquidity removal was a single transaction that returned 127,421 BUSD to the deployer, which then distributed the proceeds across several EOAs.