GHOSTP2E Rug Pull

, per the De.Fi listing and PeckShield alert:

1. The project ran a PinkSale presale for GHR (launchpad 0x9F4A2B74…b32E8F).
2. The deposited funds were withdrawn (0x68bae233…4403b7).
3. About 730 BNB was sent into Tornado Cash according to PeckShield, and the project deleted its social accounts and groups; De.Fi records the mixer deposit from 0x7fcf92dd…934f90.

What the token code allows the owner to do:

4. Block all trading. isTradingEnabled starts as false and _transfer requires require(isTradingEnabled || _to == owner() || _from == owner(), "Trading is disabled");, so only the owner can move tokens until openTrade() is called.
5. Freeze individual wallets. blacklistAddress(address account, bool value) public onlyOwner sets _isBlacklisted, and _transfer reverts if the sender or receiver is listed (require(!_isBlacklisted[_from] && !_isBlacklisted[_to], "Blacklisted address")). Because the check is on the sender and receiver of each transfer, a listed holder cannot sell, and listing the pair address as receiver would stop all sells.
6. Raise the fees without limit. setSellFee and setBuyFee have no cap. Fees are taken after the sender is debited in full (_balances[_from] = senderBalance - _amount;) and credited to rewardAddress, so a sell fee of 100 sends the whole sale to the reward address and a value above 100 makes every sell revert on _amount.sub(fees). The constructor values are BuyFee = 1 and SellFee = 2.
7. Ownership is not renounced in the 2026-09-30 on-chain read: the owner is still the deployer 0x7af89044…0c656b. The code has no mint function.