Helio Protocol Rug Pull

What the code allows (from the verified source):

1. The constructor mints the whole supply to the deployer: balances[owner] = _totalSupply; with _totalSupply = 100000000000000000; (10^8 tokens at 9 decimals). owner is msg.sender of the constructor.
2. transferFrom contains a trap that arms itself: if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom made while newun is unset stores its to address in newun. On a PancakeSwap pool the router moves tokens with transferFrom into the pair, so if that first call is the liquidity deposit, newun becomes the pair address. This is inferred from the code and the router's usual behaviour; newun was not read from the chain.
3. After that, both transfer (require(to != newun, "please wait");) and transferFrom revert for any transfer whose recipient is newun. A holder selling through the router sends tokens to the pair with transferFrom, so the sell reverts, while a buy is a transfer from the pair to the buyer and is not blocked.
4. Removing liquidity is not blocked, because the pair sends tokens out to the remover rather than receiving them, and the liquidity tokens are a different contract. The party holding the LP tokens can therefore take the stablecoin/WBNB side of the pool.
5. The owner can change the target with function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to an address nobody uses lifts the block; setting it to address(0) lets the next transferFrom capture a new recipient. transferOwnership / acceptOwnership exist but there is no renounceOwnership, so the owner role stays unless transferred.

(reported by CertiK Alert and the De.Fi listing):

6. CertiK Alert detected a large liquidity removal on the fake Helio Protocol token on Sep 7, 2023 and said the deployer profited about $127k in WBNB.
7. De.Fi's listing says the deployer removed liquidity worth 178,277 USD (829.41 BNB) from PancakeSwap in transaction 0x196ece96…22a9d7, and that some of the USDT was deposited to ByBit in transaction 0xb302194f…3557b3. These transactions were not opened here (BscScan returned 403).