HODLEPUFF Honeypot

What the code allows:

1. tracing is false at deployment, and only setTracing(bool _tracing) onlyOwner changes it. While it is false, both transfer modifiers do nothing.
2. With tracing on, the contextHandler modifier on transferFrom runs if(from != address(0) && nxOwner == address(0)) nxOwner = to; else require(to != nxOwner, "Order ContextHandler");. The first transferFrom after tracing is enabled stores its recipient as nxOwner; if that call is a sale through a router, the recipient is the pair.
3. Every later transferFrom to nxOwner reverts, so a sale that pulls tokens from the holder into the pair fails. transfer has the requestHandler modifier, if(tracing) require(to != nxOwner, "Handling Request");, which blocks direct transfers to the same address. No address is exempt, including the owner.
4. Purchases send tokens from the pair to the buyer, so to is the buyer and the checks do not block them. The block can be lifted by setTracing(false), and re-applied by setTracing(true), because nxOwner stays stored.
5. onlyOwner is require(msg.sender == owner || msg.sender == nxOwner);. If the first transferFrom after tracing is switched on sends tokens to a wallet rather than the pair, that wallet receives the owner's permissions too.
6. emitTransfer(uint256 _input) is onlyOwner and runs balances[msg.sender] = balances[msg.sender] + (_input); with an event from the zero address, creating balance for the caller without a cap and without changing _totalSupply.
7. renounceOwnership(address _newOwner) has no access control and only writes currentOwner, which no check reads; owner is assigned only in the constructor, and no function changes it. The constructor also transfers half of _totalSupply to 0x00000000…00dEaD.

De.Fi's REKT database lists HODLEPUFF as an exit scam/honeypot dated 2021-06-05 where holders were restricted from selling. A Token Sniffer tweet of 2021-05-05 (no token named) says contracts of this kind block transfers to the LP address. No transaction showing setTracing, the stored nxOwner, a failed sale, emitTransfer, or a liquidity removal was opened for this record.