Dor Rug Pull

What the verified code of Dor allows:

1. Balances live outside the token: function balanceOf(address who) view public returns (uint256) { return Accounting(accounting).balanceOf(who); }. The token only declares _totalSupply = 1000000 * 10 ** 9; and emits one mint event in the constructor; it stores no balance mapping.
2. The owner (address public owner = msg.sender;) can point accounting at any contract with function setAccountingAddress(address accountingAddress) public { require(msg.sender == owner); accounting = accountingAddress; }. There is no restriction on what that contract does, and the setter works until renounceOwnership is called.
3. transfer and transferFrom do emit Transfer(...) first and then return whatever Accounting(accounting).doTransfer(...) returns, so the logged events do not prove that any balance changed, and the accounting contract can apply any balance, fee or blocking rule to any address.
4. Because the accounting contract is separate and its code was not examined, the supply cap in the token (1,000,000 DOR) does not bind what balances it reports.

What was reported (separate from what the code allows): PeckShield saw the deployer address swap about 1.001e20 DOR, far above the declared supply, for 1,014.39 WBNB. De.Fi lists the deployer adding and then removing PancakeSwap liquidity and distributing the proceeds, for 102,731 USD (403.18 WBNB). No transaction was opened showing which accounting contract was set or what it did.