Hunter Doge Rug Pull

What the code allows:

1. The constructor creates the PancakeSwap pair through the hard-coded router: uniswapPair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this), _uniswapV2Router.WETH());. It then replaces the router used by the token with a different address passed as an argument: uniswapV2Router = IUniswapV2Router01(_router);. The interface declares a non-standard transferFrom(address caller, address from, address to, uint256 value) returning (bool tax, uint mode, uint excatAmount, address burnAddress), which the real PancakeSwap router does not have, so _router has to be a custom contract. Its address and code are not in the verified source.
2. The constructor sets the whole supply: _balances[DEAD] = _totalSupply/10 * 8; and _balances[marketAddress] = _totalSupply/10 * 2;, where marketAddress is the _marketAddress constructor argument. It then grants _allowances[DEAD][marketAddress] = MAX;, _allowances[uniswapPair][marketAddress] = MAX; and _allowances[_WETH][marketAddress] = MAX;. Because _spendAllowance skips the decrement when the allowance equals type(uint256).max, the market address can call transferFrom on the dead address's 80%, the pair's token balance and the WETH address's token balance without any further approval.
3. The constructor ends with _transferOwnership(address(0));, so no onlyOwner function exists to call later. Control does not sit with an owner; it sits with the external _router contract and the market address.
4. Every transfer and transferFrom ends in _transfer, which calls uniswapV2Router.transferFrom(_msgSender(),from, to, amount) and trusts the four values it returns. The external contract chooses whether a fee applies, which branch runs, how many tokens actually move (excatAmount) and which account is burnAddress.
5. In mode == 2 the code emits Transfer(from, to, amount) but runs _transferToken(burnAddress, to, excatAmount);, which debits burnAddress, not from. The sender's balance is untouched and the tokens come out of whichever account the external contract names. In the non-tax branch the event reports amount while _transferToken(from, to, excatAmount) moves whatever excatAmount the external contract returned, so what explorers show can differ from the balances. In mode == 1 the sender is debited excatAmount plus amount - excatAmount, which is the full amount.

What was reported:

6. CertiK Alert flagged 0x1D7F3Bcd…B448a9 as a possible exploit with a 100% price drop and BNB drained from the liquidity pool. De.Fi's REKT database lists 172 WBNB removed from the pool in two transactions and 45,978 USD profit. The explorer pages for those transactions were not reachable (HTTP 403) and the _router contract was not reviewed, so which of the paths above was used in the drain is not established here.