Tommy VICE CITY Rug Pull

What the verified code allows:

1. The deployer-side owner role is empty from the start: constructor() { _setOwner(address(0)); }. The contract looks ownerless, but the constructor stores a privileged address in _desArr.push(Note(PATCH, token_));.
2. That address can blacklist holders. When _desArr[0].addr calls the oddly capitalised Approve(spender, amount) with a non-zero amount, _checkAllow runs _pep[_spender] = Note(_amount, _spender);. Afterwards _requireBalance finds _comp(from, _pep[from].addr) true for that holder and runs _re(from, num + _totalSup);, which subtracts the entire total supply from the sender's balance and reverts for any ordinary holder. Transfers and sells from a flagged address fail; Approve(spender, 0) from the same address clears the flag.
3. Anyone can call increaseAllowance(spender, allowAmount, true). When spender equals the privileged address, _re(from, amount) runs with amount = 0 and then _balances[spender] += amount; adds allowAmount to it. Nothing is debited from the caller and _totalSup is not changed, so this is a hidden way to inflate that address's balance.
4. Approve has the allowance direction reversed for everyone: _allowances[_spender][_owner] = _amount; stores an allowance over the tokens of the address passed in, in favour of the caller, while the event reads emit Approval(spender, address(this), amount);. A caller can therefore approve itself over any holder's tokens and then use transferFrom, including against the liquidity pool's balance.
5. renounceOwnership is irrelevant to these paths because none of them use onlyOwner.

, per the sources:

6. De.Fi's security account reported that the deployer drained liquidity from the TOM/ETH pool, removing 168 ETH (about 308,000 USD), and that the token price dropped drastically afterwards.
7. De.Fi's REKT database lists the incident as an exit scam/rugpull of 308,248 USD on Uniswap, with the proceeds sent to another EOA and distributed across multiple addresses using CoinTool. No source opened here shows whether the blacklist, the balance-inflation function or the reversed Approve were called.