SHIDAO Rug Pull

What the code allows (from the verified source):

1. The constructor mints the full supply to the deployer: _mint(msg.sender, 2100_000_000_000_000 * (10**decimals())); //预挖 (comment: "pre-mine"). It also grants the deployer both DEFAULT_ADMIN_ROLE and CONFIG_ADMIN, and creates the ShiD/BUSD pair with IUniswapV2Factory(uniswapV2Router02.factory()).createPair(address(this), BUSD).
2. The deployer, the router and the token contract are whitelisted in the constructor: addNoBurnAddress(msg.sender);, addNoBurnAddress(swapV2Router);, addNoBurnAddress(address(this));. In _transfer, the branch if (_noBurnAddress[sender] || _noBurnAddress[recipient]) { super._transfer(sender, recipient, amount); } moves tokens with no fee.
3. Every other transfer takes 8% from the sender: 1% burned (super._burn(sender, burnAmount)), 1% to marketWallet, 4% to the contract for the SHIB dividend (holderAwardAmount = (amount * 4) / 100) and 2% to the LP reward reserve (LPReward = (amount * 2) / 100). The sender's balance is debited for the full amount and the recipient receives realAmount, which is 92% of it. The percentages are hard-coded; there is no fee setter.
4. CONFIG_ADMIN can change who pays the fee at any time with addNoBurnAddress(address addr) and removeNoBurnAddress(address addr), so the admin can exempt any wallet or put the fee back on any whitelisted one, including the router. The admin can also change marketWallet through setMarketWallet. marketWallet is never set in the constructor, so while it is the zero address any fee-bearing transfer reverts at super._transfer(sender, marketWallet, marketAmount) with "ERC20: transfer to the zero address".
5. Nothing in the contract limits how much a whitelisted address can sell, and the contract has no renounceOwnership; AccessControl.renounceRole exists, so the admin could give the role up, but the source shows no call to it.

(according to De.Fi's listing, not verified by a transaction here):

6. De.Fi's REKT database lists the incident as an exit scam/rug pull of about $180K on 2022-05-25. It says a funding address sent BNB to about 25 other addresses, the contract 0xC86D17c7…0Ea9A1 distributed ShiD tokens to those addresses, and the wallets then sold their tokens.