Sport Move Rug Pull

What the code allows:

1. Taxes are set by the owner with almost no limit: function setTaxes(uint8 _sellTax, uint8 _buyTax, uint8 _transferTax) external onlyOwner { require(_sellTax < 100); .... The constructor starts with sellTax = 3; but the setter accepts any value up to 99, with no delay.
2. The tax is taken out of the seller's amount and sent to the marketing pool. For a sell into a registered liquidity pool the code computes taxAmount = (amount * sellTax) / 100; and then runs super._transfer(sender, marketingPool, taxAmount); followed by super._transfer(sender, receiver, amount - taxAmount);. The seller's balance is debited the full amount; at a 99% sell tax the pool receives 1% of it and the marketing pool receives 99%.
3. The recipient of that tax is also owner-controlled: function setMarketingPool(address _marketingPool) external onlyOwner. The constructor hard-codes marketingPool = 0x2f422C25aA425ECE9f0e0E85baA149d586517bd6;.
4. The owner can block any sender: function setBlacklist(address _wallet, bool _status) external onlyOwner combined with require(!isBlacklist[sender],"User blacklisted"); at the top of _transfer. Here sender is the from address of the transfer, so blacklisting a holder blocks that holder's sells, and blacklisting the pair would block buys.
5. Sells are also rate-limited per wallet: require(lastTrade[sender] < (block.timestamp - tradeCooldown), string("No consecutive sells allowed. Please wait."));. The constructor sets tradeCooldown = 40; and setCooldownForTrades(uint8 _tradeCooldown) lets the owner change it (up to 255 seconds because of the uint8 type).
6. setLiquidityPoolStatus decides which addresses are treated as pools, so the buy and sell rules only apply to addresses the owner registers.
7. Ownership is not renounced: renounceOwnership exists, but an eth_call on 2026-09-30 still returns the deployer as owner. There is no mint after the constructor; _mint is only called once with 50000000 * 10**uint256(decimals()).

, per De.Fi's listing:

1. The project announced it was running away, SPORT fell by more than 61%, and the social accounts were frozen and deleted about 10 hours after launch.
2. A total of 507 BNB was transferred from the marketing pool address in six transactions and laundered through Tornado Cash, in transfers of 100 BNB and 1 BNB sent from the intermediate addresses listed in the description.
3. No opened source shows the owner calling setTaxes, setBlacklist, setCooldownForTrades or setMarketingPool, so whether any of these controls was used is not established, and the source of the 507 BNB in the marketing pool is not shown.