ElonMVP Rug Pull

What the code allows:

1. The constructor mints the whole supply to the deployer (_tokenBalances[_msgSender()] = _tokenTotalSupply;, 10 billion tokens at 9 decimals) and marks the deployer and the token itself as exempt: _synced[owner()] = true; _synced[address(this)] = true;. It also sets _isSwapEnabled = true; no function ever changes that flag back.
2. _isTradingOpen is false by default and only openTrading(bool value) public onlyOwner changes it. In _internalTransfer, if (!_synced[sender] && !_synced[recipient]) { require(_isTradingOpen); means that while the switch is off every transfer between non-exempt addresses reverts, including buys from the pair and sells to it. The owner can turn the switch back off at any time.
3. Because _isSwapEnabled stays true, non-exempt transfers must also pass require(sender == uniswapV2Pair || recipient == uniswapV2Pair);, so ordinary holders can only buy from or sell to the pair; wallet-to-wallet transfers revert.
4. Sells are guarded by a blacklist: if (recipient == uniswapV2Pair) { require(!_claimed[sender], "Claimed"); require(!_claimed[_msgSender()], "Claimed"); }. In a router sell the holder is sender and the router is _msgSender(), so a holder in _claimed cannot sell, and if the router address were in _claimed every router sell would revert. Buys are not affected because the recipient is then the buyer, not the pair.
5. The lists are edited by function claim(address[] calldata wallet, bool value) external onlySynced and function sync(address[] calldata wallet, bool value) external onlySynced. Any _synced address, not only the owner, can add wallets to either list, and there is no limit on how many. The owner is _synced from the constructor, so the owner is not subject to the trading switch or the sell blacklist.
6. Nothing in the contract restricts removing liquidity. A liquidity withdrawal pays tokens out of the pair (sender == uniswapV2Pair), which passes the pair rule in step 3, and the LP tokens are standard PancakeSwap LP tokens outside this contract.

What was reported:

7. De.Fi's REKT database lists the token as an exit scam/rug pull, with about 300 BNB seeded into the pool and about 170 BNB taken out when the liquidity was removed. The explorer and DEX Screener pages were not reachable (HTTP 403, and the news article host did not resolve), so this analysis does not show whether openTrading, claim or sync was ever called on-chain, or who held the LP tokens.